Get Hive Running

From zero to a fully functional data server with REST API and web frontend. Estimated time: under 10 minutes on a prepared Linux system. Hive is built as a C++23 binary — no runtime interpreter, no container required.

What you need

⚙️

GCC 14 (C++23)

GCC 14 is the tested and recommended compiler. Clang with C++23 support (clang-18+) should also work but is not the primary target.

gcc --version
# gcc (GCC) 14.x.x

# Debian/Ubuntu install:
sudo apt install gcc-14 g++-14
🔒

OpenSSL (Required)

OpenSSL is a required dependency — used for SHA-256 in migration integrity checking (chain hash), and for token hashing. The development headers must be present.

# Debian/Ubuntu
sudo apt install libssl-dev

# Fedora/RHEL
sudo dnf install openssl-devel

# Verify
openssl version
pkg-config --modversion openssl
🔨

CMake 3.20+ & Ninja

CMake for the build system. Ninja is the recommended generator — it is significantly faster than Make for incremental builds of the ~68k LOC codebase (~45k lines of C++).

cmake --version  # 3.20+
ninja --version  # any recent

# Debian/Ubuntu
sudo apt install cmake ninja-build
📦

Git (with submodules)

Required for cloning the repository. All C++ third-party libraries (Crow, SQLiteCpp, nlohmann/json, GoogleTest) are vendored as Git submodules in thirdparty/.

git --version  # any recent version

# Debian/Ubuntu
sudo apt install git

One-liner dependency install (Debian/Ubuntu)

sudo apt install build-essential gcc-14 g++-14 cmake ninja-build \
                 git libssl-dev

Vendored third-party libraries (no separate install needed)

LibraryPathPurpose
Crowthirdparty/CrowC++ HTTP/WebSocket server framework — all REST endpoints
SQLiteCppthirdparty/SQLiteCppC++ SQLite wrapper — all database operations
nlohmann/jsonthirdparty/nlohmann_jsonJSON serialisation/deserialisation
GoogleTestthirdparty/googletestUnit and integration testing framework

Step-by-step setup

1

Clone the repository and initialise submodules

Clone Hive and initialise all vendored dependencies. This will populate thirdparty/ with Crow, SQLiteCpp, nlohmann/json, and GoogleTest.

git clone https://github.com/openeggbert/hive.git
cd hive
git submodule update --init --recursive

The recursive flag is important — some submodules themselves have nested submodules (e.g., Crow's Asio dependency).

2

Configure with CMake

Configure the build directory. Hive uses Ninja for speed. The example below shows a production Release build with all performance flags enabled.

Minimal configuration (development)

cmake -S . -B build \
  -G Ninja \
  -DCMAKE_BUILD_TYPE=Debug

Production configuration (recommended)

cmake -S . -B build \
  -G Ninja \
  -DCMAKE_BUILD_TYPE=Release \
  -DCMAKE_CXX_FLAGS="-O3" \
  -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON \
  -DCMAKE_UNITY_BUILD=ON

Key CMake flags reference

FlagValueEffect
CMAKE_BUILD_TYPERelease / DebugOptimisation level and debug symbols
CMAKE_CXX_FLAGS-O3Maximum optimisation — important for production performance
CMAKE_INTERPROCEDURAL_OPTIMIZATIONONLink-Time Optimisation (LTO) — enables cross-translation-unit inlining
CMAKE_UNITY_BUILDONUnity (jumbo) build — combines multiple .cpp files to reduce compilation time and improve LTO quality
ENABLE_TESTSON (default)Build the GoogleTest test suite (Tests target)
MINDNET_ENABLE_DICTIONARY_PLUGINON (default)Build the Dictionary plugin
ALLOW_LEGACY_PLUGINSOFF (default)Enable the legacy plugin set — unlocks MINDNET_ENABLE_SLIPBOX_PLUGIN (ON) and MINDNET_ENABLE_REPETITION_PLUGIN (OFF)
MINDNET_ENABLE_HISTORYON (default)Compile in the history audit subsystem
MINDNET_ENABLE_API_LOGOFF (default)Compile in per-request api_log persistence

CMake detects OpenSSL automatically via find_package(OpenSSL REQUIRED). If OpenSSL is in a non-standard path, set -DOPENSSL_ROOT_DIR=/path/to/openssl.

3

Build the application binary

Compile the hive_app target. First build takes a few minutes (all vendored dependencies compile from source). Subsequent incremental builds are fast with Ninja.

cmake --build build --target hive_app

# Or with explicit parallelism (adjust to your CPU core count)
cmake --build build --target hive_app -- -j8

The compiled binary is placed at build/src/hive-app/hive_app.

Alternatively, the repository ships a build.sh script that performs a clean Release build and assembles a timestamped distribution directory containing the binary, configuration/, and frontend/.

4

Run the server

Start Hive with the frontend directory, port, and host settings. The -s flag points to the static frontend files.

./build/src/hive-app/hive_app start \
  --port 9000 \
  --frontend-port 9000 \
  --host http://localhost \
  -s ./frontend

On startup Hive loads configuration/hive.properties, resolves plugin dependency order, applies pending migrations (verifying SHA-256 checksums and chain hashes), builds the model/validator/trigger/job/query registries, generates all HTTP routes, starts the cron scheduler (4 worker threads), and begins accepting connections on the configured port.

All start options (parsed in Main.cpp): -p/--port, -f/--frontend-port, -h/--host, -s/--static-directory.


After the server starts

Access the web frontend

http://localhost:9000/web/

The Hive web frontend loads, reads /api/v1/model_definition, and builds navigation from all registered plugin models.

Explore the API

# Full metadata contract (drives frontend)
http://localhost:9000/api/v1/model_definition

# Health probe — returns 200 OK with server uptime
http://localhost:9000/health

# Runtime info — name, version, build_time, environment,
# host/ports, access_mode, registration_mode, default_user_role
http://localhost:9000/info

Plugin-specific apps

http://localhost:9000/web/app_slip_box.html
http://localhost:9000/web/app_dictionary.html
http://localhost:9000/web/app_repetition.html

Initial administrator login

On the very first start, if no users exist in the database, Hive auto-generates a random administrator password and writes it to pw.txt in the working directory.

⚠️

Security checklist — first run

  1. Open pw.txt and copy the admin username and password securely (password manager).
  2. Delete pw.txt immediately — it contains plaintext credentials.
  3. Log in to the frontend with the saved credentials.
  4. Change the administrator password via POST /api/v1/auth/change_password or the auth UI.
  5. Review access_mode and registration_mode in configuration/hive.properties for your deployment needs.

Test authentication via cURL

# Login
curl -s -X POST http://localhost:9000/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"YOUR_PW"}' | jq

# Use the returned access_token
TOKEN="3f9c2a..."
curl -s http://localhost:9000/api/v1/dictionary_term \
  -H "Authorization: Bearer $TOKEN" | jq

Configuration File Reference

Hive reads configuration/hive.properties on startup. Command-line flags override configuration file values. The actual default configuration shipped with the repository:

# === configuration/hive.properties (real shipped example) ===

#Identification
name=Robert Vokac
description=Zettelkasten system for Robert Vokac
environment=Development
dev_mode=false
#
#host=
#port=
#frontend_port=
database_type=SQLite

#Access
access_mode=PublicFullAccess
registration_mode=Free
default_user_role=Reader

#Other
max_log_level=ERROR
allowed_plugins=slip_box, repetition, dictionary
access_token_expires_in=15                  # minutes
refresh_token_expires_in=43200              # minutes (= 30 days)
refresh_token_rotation_threshold_in=10080   # minutes (= 7 days)

Configuration keys reference

KeyValuesDescription
access_modeMaintenanceMode, AdminsReadOnly, AdminsReadWrite, AuthenticatedReadOnly, AuthenticatedReadWrite, AuthenticatedFullAccess, PublicReadOnlyAuthenticatedReadOnly, PublicReadOnlyAuthenticatedReadWrite, PublicFullAccessGlobal API access gate (see access matrix on the home page)
registration_modeFree / RequiresAdminApproval / AdminAddsUsersWho may create accounts
default_user_roleGuest, Reader, Editor, Reviewer, Admin, SuperAdminRole assigned to newly registered users
database_typeSQLite (default) / PostgreSQL (groundwork)Persistence backend; PostgreSQL adds db_host, db_port, db_name, db_user, db_password
allowed_pluginscomma-separated namesDomain plugins allowed to load (core is always loaded)
max_log_levellog level nameLogging verbosity ceiling
access_token_expires_inminutes (validated 5 min – 30 days)Access token lifetime
refresh_token_expires_inminutes (validated 1 day – ~300 days)Refresh token lifetime
read_cache_capacity_size / read_cache_capacity_bytesintegerModelCache capacity limits
dev_mode / environmentbool / labelDevelopment toggles and environment name shown in /info

Configuration can also be edited at runtime by a SuperAdmin via the built-in web form at /api/v1/superadmin/configure — fields requiring a restart (host, ports, database, allowed plugins) are marked, with an optional scheduled restart.

Command-line flags reference (start command)

FlagExampleDescription
-p, --port <n>9000HTTP server port
-f, --frontend-port <n>9000 (or 443 behind TLS proxy)Port the frontend uses for API calls (relevant behind a reverse proxy)
-h, --host <url>http://localhostHost URL base (used for absolute URL generation)
-s, --static-directory <path>./frontendPath to frontend static files directory

Command-line flags override the corresponding hive.properties values. Everything else (tokens, access mode, plugins, cache) is configured via the properties file or the SuperAdmin configure UI.

Access mode recommendations by deployment type

DeploymentRecommended access_modeReasoning
Local developmentPublicFullAccess (8)No auth friction during development
Private personal serverAuthenticatedFullAccess (5) or AuthenticatedReadWrite (4)All users must log in; write access per role
Small team / internalAuthenticatedReadWrite (4)Login required; roles control writes; validators add per-model rules
Public read / private writePublicReadOnlyAuthenticatedReadWrite (7)Guests read; authenticated users write according to roles
Maintenance windowMaintenanceMode (0)All requests rejected — migration or upgrade in progress

Running as a systemd Service

Hive ships with a hive.service systemd unit file for running as a Linux daemon. Edit paths to match your installation before enabling.

# hive.service — real template shipped in the repository
# (replace the {PLACEHOLDER} values with your paths)
[Unit]
Description=Hive (C++ REST backend)
After=network.target

[Service]
Type=simple
User={USER}
Group={USER}
WorkingDirectory={WORKING DIRECTORY}

ExecStart={PATH}/hive start --port 9000 --frontend-port 443 \
    --host {HOST} -s {PATH TO frontend}
Restart=on-failure
RestartSec=5s

Environment=USER={USER} HOME={HOME}

StandardOutput=append:/var/log/hive.log
StandardError=append:/var/log/hive.err

# kill settings — graceful shutdown
KillSignal=SIGINT
TimeoutStopSec=10

[Install]
WantedBy=multi-user.target

Note the template's --frontend-port 443: when a TLS reverse proxy terminates HTTPS on 443, the frontend must call the API through the proxy port, not Hive's internal port.

# Install and enable
sudo cp hive.service /etc/systemd/system/
sudo nano /etc/systemd/system/hive.service     # edit paths

# Enable and start
sudo systemctl daemon-reload
sudo systemctl enable hive
sudo systemctl start hive

# Status and logs
sudo systemctl status hive
sudo journalctl -u hive -f                     # live log tail
sudo journalctl -u hive --since "1 hour ago"   # last hour

Production security considerations


Running the Test Suite

Hive ships a GoogleTest/GoogleMock test suite under tests/, built as the Tests target (enabled by default via ENABLE_TESTS=ON) and registered with CTest through gtest_discover_tests().

# Configure with tests (ON by default)
cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DENABLE_TESTS=ON
cmake --build build --target Tests

# Run all tests via CTest
cd build && ctest --output-on-failure

# Run a specific test filter
ctest -R "PluginRegistry" --output-on-failure

# Run directly with GoogleTest output
./build/tests/Tests --gtest_filter="AccessMode*"

Test coverage areas (from tests/hive/)

Test file / areaWhat is verified
UtilsTests.cppShared utility functions (string/time helpers, hashing)
AccessModeTests.cppAll 9 access mode enum values and the AccessMode × UserRole × CRUDL permission matrix
api/PluginRegistryTests.cppTopological sort correctness, CyclicDependencyException and MissingDependencyException detection
api/cronq/Cron expression parsing and scheduling logic of the cronq scheduler

Common Issues

SymptomLikely causeFix
CMake error: Could not find OpenSSL OpenSSL development headers not installed sudo apt install libssl-dev (Debian/Ubuntu) or set -DOPENSSL_ROOT_DIR=...
Compiler error: feature not supported with this compiler GCC version too old for C++23 Install GCC 14: sudo apt install gcc-14 g++-14; set -DCMAKE_CXX_COMPILER=g++-14
Server starts but /web/ returns 404 Wrong frontend path in -s flag Verify -s ./frontend points to the directory containing index.html
Migration integrity error on startup An already-applied embedded migration script was modified (checksum or chain-hash mismatch) Revert the migration script to its original content, or delete the database and restart (data loss — dev only)
MissingDependencyException on startup A plugin listed in allowed_plugins does not exist or its dependency is not enabled Check allowed_plugins in hive.properties; ensure all dependency plugins are listed
Frontend shows no models / empty navigation /api/v1/model_definition returns empty or CORS issue Check server logs; verify allowed_plugins has correct plugin names; try curl http://localhost:9000/api/v1/model_definition
Login returns 403 even with correct credentials access_mode=MaintenanceMode or user status is Pending/Banned Check access_mode in config; check user record status in user table

Want to extend Hive?

Now that you have a running instance, explore the Developer Guide to understand how to add your own plugin with models, validators, triggers, and scheduled jobs.