7c0a622d41
A rebuild's MetaSync resolves the head of the swarm's internal/meta once and records it; the prebuild and the swap build that flake instead of the hive's own, and a first deploy does the same in Create. hive-priv takes the commit as a validated meta_rev on UpdateContainer and CreateContainer and builds from its own forge URL (HIVE_PRIV_FORGE_URL). The head is used only when its flake lists the agent at the config commit the forge's main is at; otherwise, and when the repo has no commit or this hive has no core token file for nix's git, the hive renders locally as before. hive-c0re's and hive-priv's gitconfig now share the forge credential helper and rewrite the forge's https URLs to http, which hive-priv lacked.
44 lines
1.9 KiB
Nix
44 lines
1.9 KiB
Nix
# Git settings for the host processes that hand nix a forge URL: hive-c0re
|
|
# (prebuilds as `hive-core`) and hive-priv (builds as root, with a HOME of its
|
|
# own), each through its own `$HOME/.gitconfig`. nix runs `git` for a `git+…`
|
|
# input, so git's config is the only credential and URL plumbing it has.
|
|
#
|
|
# - `credential`: the forge host answers through `git-credential-hive-forge`,
|
|
# which reads the live `core` token file. An empty `helper =` first resets the
|
|
# list, so no /etc/gitconfig helper (e.g. `oauth`, which waits on a browser)
|
|
# runs ahead of ours.
|
|
# - `url`: the swarm's `internal/meta` lock names its inputs by the forge's
|
|
# `https` URL, which only the builder's credential helper answers for. They
|
|
# are fetched over the `http` URL the helper above is scoped to.
|
|
#
|
|
# Pure function — NOT a NixOS module (don't add it to the host-modules
|
|
# aggregator). Call it from a module's `let`:
|
|
#
|
|
# forgeGit = import ./lib/hive-forge-git.nix { inherit pkgs; forgeDomain = …; };
|
|
# # then put `forgeGit.credentialHelper` on the unit's `path` and
|
|
# # `forgeGit.config` into its gitconfig.
|
|
{ pkgs, forgeDomain }:
|
|
{
|
|
# Answers only `get`, for the forge `core` user, from the live token file
|
|
# (`/var/lib/hyperhive/forge-core-token`, hive-c0re's `paths::FORGE_CORE_TOKEN`)
|
|
# on every invocation, so it never holds a stale copy and survives token
|
|
# rotation; prints nothing where the file is absent.
|
|
credentialHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
|
|
[ "''${1:-}" = "get" ] || exit 0
|
|
if [ -r /var/lib/hyperhive/forge-core-token ]; then
|
|
printf 'username=core\n'
|
|
printf 'password=%s\n' "$(cat /var/lib/hyperhive/forge-core-token)"
|
|
fi
|
|
'';
|
|
|
|
config = ''
|
|
[credential]
|
|
helper =
|
|
[credential "http://${forgeDomain}"]
|
|
helper =
|
|
helper = hive-forge
|
|
username = core
|
|
[url "http://${forgeDomain}/"]
|
|
insteadOf = https://${forgeDomain}/
|
|
'';
|
|
}
|