hive

One binary runs the fleet.

Every application at Optersoft is a Rust binary on a Hetzner VM. hive is what puts it on the network and keeps it there: a TLS gateway per VM, a host-hardening agent, a log shipper, and the toolkit that deploys from the laptop — one program, four subcommands.

hive gateway          # one :443 per VM, routed by Host header to each app     (gateway.service)
hive run              # the agent: compiled-in hardening, reconciled each tick  (hive.service)
hive log run          # seal the journal into encrypted segments, ship them     (hive-log.timer)
hive fleet deploy …   # from the laptop: deploy, roll back, fail over, retire

The same source is built twice: a static musl binary for the VMs (no libc, no dependencies, runs on any x86-64 Linux) and a native build for the laptop. Every VM runs exactly one file under three systemd units, so hive --version answers for all of them and the fleet has one version per box.

What is inside

CrateThe question it answersWhere it runs
hive-serverHow does a binary serve itself, and swap for a new build without dropping a connection?compiled into every app
hive-gatewayHow do several apps on one VM share port 443 and one certificate?hive gateway
hive-hostWho keeps the VM hardened after the deploy is over?hive run
hive-logWhat did all of that print, and where did it go?hive log
hive-deployHow does a build get from the laptop to the box, and back if it was wrong?hive fleet

The first is a library the applications depend on. The other four are the programs inside this binary. The design — the fork/exec upgrade, the per-tenant certificates, the encrypted log archive, the signed deploy packages — is written up at academy.optersoft.com/project/hive.

Download

Version 0.2.0, released 2026-09-06 from commit ee879c17b.

FilePlatformSizesha256
hive-x86_64-linux.gzx86_64-unknown-linux-musl14.1 MB1dd6e0e07a30e28ba65008abe44cf4c2aba42933a3433c607738367a541e4c2a
hive-aarch64-macos.gzaarch64-apple-darwin12.3 MB1b6e3858933b5968689e1a108ca022d2c45749e76f78446954522d153ccc3ce2
checksums.txt, .sig, release.jsonthe hashes, the signature, and the commits it was built from

Install

On a VM (x86-64 Linux, any distribution):

curl -fsSL https://hive.optersoft.com/latest/hive-x86_64-linux.gz | gunzip > hive
chmod +x hive && ./hive --version

On the laptop (Apple Silicon macOS):

curl -fsSL https://hive.optersoft.com/latest/hive-aarch64-macos.gz | gunzip > hive
chmod +x hive && ./hive --version

/latest/ always redirects to the current version; pin one with /v0.2.0/ instead. latest.json and releases.json carry the same facts for a script.

Verify

Each release directory holds checksums.txt (the sha256 of every file), an ed25519 signature over its exact bytes, and the public key. The source is private, so the signature is the claim: only the key that lives on one laptop can produce it. release-key.pem is the same key for every release.

cd v0.2.0   # after downloading the files above into it
sha256sum -c checksums.txt
openssl pkeyutl -verify -pubin -inkey release-key.pem -rawin \
    -in checksums.txt -sigfile checksums.txt.sig

On macOS, shasum -a 256 -c checksums.txt. Compare the key against a copy you already trust — that comparison is the only check this page cannot do for you.

Versions