| Filename | Latest commit message | Latest commit date |
|---|---|---|
e7f4a19939
Fixes hyperhive#3223. swarm-controller: GET /api/hives (utoipa-annotated same as /health), serving the swarm's hive directory (name + domain) loaded once at startup from a new SWARM_CONTROLLER_HIVES env var. The controller's NixOS module sets it from services.hyperhive.swarm.hives, JSON-encoded the same way hive-c0re already builds HYPERHIVE_PEERS for its own peer list (environment.nix) — the full directory here rather than peers-minus-self, since a swarm-level daemon has no 'self' hive to exclude. Unset/malformed both fall back to an empty list with a warning rather than failing startup, so /health stays answerable even if this one env var is wrong. swarm-ui: App.tsx's Home route fetches /api/hives and renders it through the already-merged <Table>/<StatusChip>/<Panel> primitives — name, domain (linking out to that hive's own gateway-routed dashboard), and a static "configured" status chip until a real online/stale/offline rollup exists server-side. Also gave swarm-ui a base <a> color (theme's --blue) — base.css covers body/typography but not links, and this is genuinely page-level rather than any one component's concern. Verified end to end, not just source-reading: ran the real swarm-controller binary with SWARM_CONTROLLER_HIVES set, curled /api/hives + /health over its actual unix socket; separately served the real swarm-ui dist against a mock /api/hives and screenshotted the rendered table. Also re-verified the nginx wiring evaluates (same throwaway nixosSystem eval technique as #3212) — SWARM_CONTROLLER_HIVES resolves to the expected JSON shape. cargo test/clippy -p swarm-controller clean (2 tests, including a new load_hives one covering missing/malformed/valid env var states). npm run build + typecheck clean. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
swarm-controller
The swarm-level daemon. Where hive-c0re owns the agents on one host, this
owns what is true across hives — so a swarm runs one of them and most hives
leave it off.
Opt-in per host via services.hyperhive.swarm.controller.enable, which is
deliberately not derived from services.hyperhive.enable: turning it on is
a statement about swarm topology, not about whether hyperhive is installed.
What it does today
Serves one /health endpoint and holds no state.
That is the whole intent of the first slice. The point is to make the unit
real — service user, runtime and state directories, socket, nginx
reachability — so the swarm-level surfaces that follow have somewhere to land.
Inventing those surfaces before they are agreed would bake in a shape nobody
chose. See #3066 and the hyperhive.swarm consolidation epic.
Why a unix socket, not a port
The hive-gateway's nginx is the only intended client and reaches the socket through a bind-mount. A listener that is never bound to an address cannot be reached from off-host by mistake.
The socket path is services.hyperhive.swarm.controller.socketPath, default
/run/swarm-controller/controller.sock, exported to the process as
SWARM_CONTROLLER_SOCKET.
⚠️ The socket's directory is its access control
The socket is 0666. It has to be: nginx runs as a different user and
connect(2) needs write. This matches how hive-c0re publishes the per-agent
sockets, and rests on the same argument — "the bind source dir is per-agent on
host so blast radius is unchanged."
What keeps that safe is that the directory holds one socket. So:
Never point
socketPathat a directory that carries anything else./run/hyperhiveabove all — it holdshost.sock, the host admin socket. Pointing nginx at that directory to reach this socket would put the admin socket within its reach too.
nginx is a host service, so nothing narrows what it can reach except the directory itself — that is the whole of the access control. A unit test pins the default path so a tidying edit fails instead of reviewing cleanly.
RuntimeDirectoryPreserve=yes and the daemon's stale-socket unlink on start are
a pair: preserving the directory without the unlink means bind fails with
EADDRINUSE after a restart.
Packaging
Built by the workspace derivation and extracted as its own package
(nix build .#swarm-controller). Deliberately not in nix/packages'
daemonBins — that list is the core stack and drives the bundle
services.hyperhive.c0re.package points at, so folding this in would put a
swarm-scoped service into every hive's closure.