mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nightly vm test: full single-host swarm setup up to the meta flake

Browse source
This commit is contained in:
atlas 2026-11-06 20:25:38 +01:00
commit af434e1374
3 changed files with 559 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

5
hive-meta-flake/README.md
View file

@ -13,3 +13,8 @@ helpers.
`testdata/meta-flake.nix.in` is the render for one archetype agent with a
placeholder for the hyperhive pin. A unit test keeps it equal to `render_flake`'s
output, and the `swarm-builder-offline` VM test (`nix/vm-tests/`) serves it.
`testdata/meta-flake-swarm.nix.in` is the render for two archetype agents with
the forwarded values of a single-host swarm as `@<NAME>@` placeholders, kept equal
by a unit test the same way. The `full-setup` VM test fills it in with the
controller's own settings and builds the agents' toplevels from it.

35
hive-meta-flake/src/lib.rs
View file

@ -583,6 +583,41 @@ mod tests {
}
}
/// `testdata/meta-flake-swarm.nix.in` is the flake `nix/vm-tests/full-setup.nix`
/// evaluates and serves: two archetype agents, the seven forwarded values a
/// single-host swarm without a display name sets, each as `@<NAME>@`, and
/// `@HYPERHIVE_URL@` where the pin goes. It must be what [`render_flake`]
/// renders for them.
#[test]
fn the_full_setup_fixture_is_what_render_flake_renders() {
let archetype = || {
Some(ArchetypeRef {
source: "hyperhive".to_owned(),
name: "reviewer".to_owned(),
})
};
let vars: Vec<(&'static str, String)> = FORWARDED_VARS
.iter()
.filter(|name| **name != "HYPERHIVE_SWARM_NAME")
.map(|&name| (name, format!("@{name}@")))
.collect();
let flake = render_flake(
"@HYPERHIVE_URL@",
&[
spec("iris", archetype(), None),
spec("ruth", archetype(), None),
],
&vars,
false,
)
.unwrap();
assert_eq!(
flake,
include_str!("../testdata/meta-flake-swarm.nix.in"),
"update the fixture to the rendered flake"
);
}
#[test]
fn a_rendered_flake_names_the_commit_each_input_is_pinned_to() {
let flake = rendered();

94
hive-meta-flake/testdata/meta-flake-swarm.nix.in vendored Normal file
View file

@ -0,0 +1,94 @@
{
description = "hyperhive deployed agents";
inputs = {
hyperhive.url = "@HYPERHIVE_URL@";
nixpkgs.follows = "hyperhive/nixpkgs";
};
outputs =
{ self, hyperhive, ... }@inputs:
let
mkAgent = { name, port, archetype ? null }:
let
base = hyperhive.nixosConfigurations.agent-base;
# Every flake an archetype can come from, by its source name.
archetypeSources = { inherit hyperhive; };
agentModule =
if archetype == null then
inputs."agent-${name}".nixosModules.default
else
(archetypeSources.${archetype.source}
or (throw "agent ${name}: archetype source ${archetype.source} is not an input of this hive's meta flake")
).hyperhiveArchetypes.${archetype.name}.module
or (throw "agent ${name}: this hive's ${archetype.source} input has no archetype ${archetype.name}; update that input");
service = "hive-agent";
# One attrset for `environment.variables` (login shells),
# `systemd.globalEnvironment` (every unit) and the harness service,
# so the three cannot disagree. The forwarded vars come from the host.
agentEnv = {
HIVE_LABEL = name;
HYPERHIVE_STATE_DIR = "/agents/${name}/state";
HYPERHIVE_HARNESS_DIR = "/agents/${name}/harness";
HIVE_AGENT_BAO_ADDR = "@HIVE_AGENT_BAO_ADDR@";
HIVE_AGENT_BAO_SERVICES_PKI_MOUNT = "@HIVE_AGENT_BAO_SERVICES_PKI_MOUNT@";
HIVE_AGENT_LOGS_QUERY_URL = "@HIVE_AGENT_LOGS_QUERY_URL@";
HIVE_AGENT_METRICS_URL = "@HIVE_AGENT_METRICS_URL@";
HIVE_FORGE_URL = "@HIVE_FORGE_URL@";
HIVE_FORGE_PUBLIC_URL = "@HIVE_FORGE_PUBLIC_URL@";
HIVE_MATRIX_URL = "@HIVE_MATRIX_URL@";
};
in
base.extendModules {
modules = [
agentModule
{
services.hyperhive.agent.bao.addr = "@HIVE_AGENT_BAO_ADDR@";
services.hyperhive.agent.bao.servicesPkiMount = "@HIVE_AGENT_BAO_SERVICES_PKI_MOUNT@";
services.hyperhive.agent.logs.queryUrl = "@HIVE_AGENT_LOGS_QUERY_URL@";
services.hyperhive.agent.metrics.url = "@HIVE_AGENT_METRICS_URL@";
services.hyperhive.agent.forge.url = "@HIVE_FORGE_URL@";
services.hyperhive.agent.matrix.url = "@HIVE_MATRIX_URL@";
# The harness service inside the container runs as a
# non-root unix user named after the agent (`damocles`,
# `iris`, `root`, …). UID auto-assigned by NixOS; the
# per-agent override here is what makes
# `services.hyperhive.agent.user.name` match the agent's identity
# instead of the harness default of `"agent"`.
services.hyperhive.agent.user.name = name;
# Without this an agent container is called `nixos` and ships
# every log line under that: nixpkgs sets the hostname from the
# attr name in the `containers.<name>` submodule, and an
# agent's system is its own `nixosSystem` off this flake, which
# never evaluates that option. The machine name, not the
# logical one — it is what `container.name` on our metrics and
# nspawn itself already call this container, so logs join to
# both without a prefix transform.
networking.hostName = "h-${name}";
programs.git.config.user = {
name = name;
email = "${name}@hyperhive.local";
};
# Container-wide env, all from `agentEnv`: every unit and daemon
# (the bash-task runner where `hive-forge` and `git` run included)
# resolves the state dir and the forwarded service URLs without
# redeclaring them. `environment.variables` is what login shells
# read; `systemd.globalEnvironment` is the analogue for units.
environment.variables = agentEnv;
systemd.globalEnvironment = agentEnv;
systemd.services.${service}.environment = agentEnv // {
HIVE_PORT = toString port;
};
}
# Tells the harness the agent has no config repo of its own.
(if archetype == null then { } else {
systemd.services.${service}.environment.HIVE_ARCHETYPE = archetype.name;
})
];
};
in
{
nixosConfigurations = {
iris = mkAgent { name = "iris"; port = 8178; archetype = { source = "hyperhive"; name = "reviewer"; }; };
ruth = mkAgent { name = "ruth"; port = 8232; archetype = { source = "hyperhive"; name = "reviewer"; }; };
};
};
}