openvibers/openvibe.link Commits

Node: install --worker, a machine that runs its owner's jobs (job user, public egress, the OpenVibe.Codes job runner) (#38)

OP OpenVibers committed 30 days ago · tag v0.4.0 · 0 files, +0 −0

Plan T14/T16: `openvibe.bot/machines` (Bot#98) prints `curl … | sh -s -- --network … --pairing pair_… --code … --worker` to add a machine that runs its owner's jobs, such as a coding task started on openvibe.codes/run (Codes#62). This teaches the installer `--worker`.

**`--worker`** (Linux; `install/install.sh`)
- **Service user:** the service runs as root, which the sandbox's `run_as` and its public egress (veth, NAT, the Node's nftables table) need. Each job still runs as the unprivileged system user `openvibe-job`, created with no login and no home.
- **Egress tools:** `nftables`, `iproute2` and `util-linux` are installed with apt when missing; otherwise a warning says internet jobs will be refused. IPv4 forwarding is turned on in `/etc/sysctl.d/90-openvibe-node-worker.conf` when it is off.
- **Codes runner:** with Node.js 20+ installed system-wide (`/usr/bin/node` or `/usr/local/bin/node`), OpenVibe.Codes `v0.3.0` (`OPENVIBE_CODES_VERSION` overrides) goes into `/opt/openvibe-codes`, root-owned and not group- or world-writable as the sandbox requires. It is declared as the `code` entry `[email protected]`, running `node …/openvibe-codes.js job` with `artifact_dir` `/opt/openvibe-codes`. Without Node.js the worker is on with no runner, and the installer says how to add it.
- **Config:** `write_worker_config`, a python3 merge (python3 is already required), sets `worker` in `config.json`:
  - `enabled`, `run_as`, `egress: public`;
  - caps for a coding task: an hour, 4 GiB, 3 GiB of scratch, 2 cores, 512 pids, one job, and a 64 TiB address space for Node.js;
  - an `env` with empty key slots (`DEEPSEEK_API_KEY`, `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GITHUB_TOKEN`).
  - Everything else in the file stays; a second run keeps the owner's keys and caps and declares the runner once. The file stays 0600.
- The installer's last lines say where the keys go and how to add agent CLIs system-wide.
- Test hook `OPENVIBE_INSTALL_WORKER_CONFIG_ONLY=<file>` writes only the worker section and exits, like the existing pair-args hook.

**Docs**
- `docs/worker.md`: "A machine that runs your coding tasks (`--worker`)", covering the ownership chain, what the flag does, keys, agents, and what a task does on the machine.
- `docs/install.md` and the README point to it.

**Tests**
- New `scripts/test-install-worker-config.sh`, added to CI:
  - the first run merges into an existing config and declares the runner;
  - a second run keeps an owner's key and cap with no duplicate;
  - without Node.js, no runner and a 0600 file.
- `test-install-pair-args.sh` still passes; shellcheck is clean on the installer and the new test.

**After merge:** tag Node v0.4.0 (the installer is served from the latest release) once Codes v0.3.0 is tagged.