| Filename | Latest commit message | Latest commit date |
|---|---|---|
0e1a975f9f
`agents.conf` and `gateway.htpasswd` move from /var/lib/hyperhive/gateway to /var/lib/hive-gateway/conf, alongside the `tls/` the gateway already kept there. nginx reads both as an unprivileged user. Under c0re's state dir it could only reach them by traversing a directory systemd re-declares `0750 hive-core` on every c0re start — so nginx was given `SupplementaryGroups = [ "hive-core" ]`, which also handed it read access to everything else group-readable in that tree. The tokens are individually 0600, but the broker sqlite carries no explicit mode: every message between every agent was readable by the process whose job is parsing untrusted network input. Moving the files removes the need and the exposure together. The group is gone, and its absence is now commented as load-bearing so it doesn't come back as a fix for a symptom it would recreate. Also drops this module's `/var/lib/hyperhive` tmpfiles rule. It declared `0755 root root` and could never win against `StateDirectoryMode`, and a losing declaration still reads as a guarantee — that is what sent the first diagnosis of the outage looking for who had changed the mode. Ordering is unchanged and still the thing that makes a fresh boot work: tmpfiles runs before services and seeds both files empty-but-valid, nginx names them (an `include` of a missing file is fatal, not empty), and content arrives when c0re writes and reloads — which it does on every topology change, so a boot against the empty seed resolves itself. Folds in the mode fix: `write` now sets 0644 on the tmp file before the rename, because a rename carries the source's mode and discards the destination's, and the tmpfiles rule that declares 0644 is create-if-absent so it never re-applies. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
hive-host-sock
Wire types for the host admin socket (/run/hyperhive/host.sock) — the
host-control protocol spoken between the hivectl operator CLI and the
hive-c0re daemon.
Why it's its own crate
Re-homed out of hive-sh4re so a standalone hivectl depends on just this
protocol crate instead of the whole daemon-shared crate. hivectl drives the
full hive (spawn / kill / destroy / rebuild / deploy) over this socket without
linking hive-c0re; keeping the request/response shapes here is what makes that
thin dependency possible.
Shape
Serde-derived request/response enums for the host admin protocol. The larger
shared payload types some variants reference (Approval, AgentStatusRow)
stay in hive-sh4re — this crate is only the protocol envelope, no server or
client implementation.
Its own jobs module is the exception: the job-queue vocabulary hivectl
needs (Source, State, PermPayload, NodeId) is protocol-local. The typed
DagView/NodeView projection that used to live there is gone — the queue is
served as a generic graph (hive-jobq-wire), not as a second hand-written
view.
See docs/boundary.md (host admin socket access) for the trust model around who
may connect to the socket, and hive-priv-sock for the sibling split on the
privileged-helper socket.