# Where the agent's nix builds run: `services.hyperhive.agent.nixBuilds`.
#
# The mode reaches the container's start flags through the closure record
# (hive-priv adds `--tmpfs=/nix/var/nix/daemon-socket` for `none`); this module
# is the part inside the container's own NixOS config.
{ lib, config, ... }:
{
  options.services.hyperhive.agent.nixBuilds = lib.mkOption {
    type = lib.types.enum [
      "host"
      "none"
    ];
    default = "host";
    example = "none";
    description = ''
      Where this agent's nix builds run.

      - `host` (default): builds go through the host's nix-daemon socket,
        which every agent container gets bound in by default. The daemon runs
        them outside this container, so the container's CPU and memory caps do
        not apply to a build.
      - `none`: the container cannot reach the host's nix-daemon, so
        `nix build`, `nix run`, `nix shell` and the like fail for anything not
        already in the store, with a "cannot connect to socket" error. The
        agent's own system closure stays readable.
        The container's own nix-daemon socket and service are off, so nothing
        in the container listens on that path either.

      The swarm builder reads the option from the evaluated config into the
      agent's closure record, and the hive applies it when it next starts the
      container, so a running agent keeps its mode until restarted. A host
      that does not know the option leaves the agent on `host`.
    '';
  };

  # Under `none` the daemon directory is an empty tmpfs, which the nix-daemon
  # socket unit's `ConditionPathIsReadWrite` accepts, so the container's own
  # daemon would listen there and hand out the very socket the mode withholds.
  # Under `host` the directory is the host's read-only bind, the condition
  # fails, and the unit stays inactive. `nix.enable` stays on, so the client and
  # the read-only store remain usable.
  config = lib.mkIf (config.services.hyperhive.agent.nixBuilds == "none") {
    systemd.sockets.nix-daemon.enable = false;
    systemd.services.nix-daemon.enable = false;
  };
}