46 lines
2.1 KiB
Nix
46 lines
2.1 KiB
Nix
# Where the agent's nix builds run: `services.hyperhive.agent.nixBuilds`.
|
|
#
|
|
# The mode reaches the container's start flags through the closure record
|
|
# (hive-priv adds `--tmpfs=/nix/var/nix/daemon-socket` for `none`); this module
|
|
# is the part inside the container's own NixOS config.
|
|
{ lib, config, ... }:
|
|
{
|
|
options.services.hyperhive.agent.nixBuilds = lib.mkOption {
|
|
type = lib.types.enum [
|
|
"host"
|
|
"none"
|
|
];
|
|
default = "host";
|
|
example = "none";
|
|
description = ''
|
|
Where this agent's nix builds run.
|
|
|
|
- `host` (default): builds go through the host's nix-daemon socket,
|
|
which every agent container gets bound in by default. The daemon runs
|
|
them outside this container, so the container's CPU and memory caps do
|
|
not apply to a build.
|
|
- `none`: the container cannot reach the host's nix-daemon, so
|
|
`nix build`, `nix run`, `nix shell` and the like fail for anything not
|
|
already in the store, with a "cannot connect to socket" error. The
|
|
agent's own system closure stays readable.
|
|
The container's own nix-daemon socket and service are off, so nothing
|
|
in the container listens on that path either.
|
|
|
|
The swarm builder reads the option from the evaluated config into the
|
|
agent's closure record, and the hive applies it when it next starts the
|
|
container, so a running agent keeps its mode until restarted. A host
|
|
that does not know the option leaves the agent on `host`.
|
|
'';
|
|
};
|
|
|
|
# Under `none` the daemon directory is an empty tmpfs, which the nix-daemon
|
|
# socket unit's `ConditionPathIsReadWrite` accepts, so the container's own
|
|
# daemon would listen there and hand out the very socket the mode withholds.
|
|
# Under `host` the directory is the host's read-only bind, the condition
|
|
# fails, and the unit stays inactive. `nix.enable` stays on, so the client and
|
|
# the read-only store remain usable.
|
|
config = lib.mkIf (config.services.hyperhive.agent.nixBuilds == "none") {
|
|
systemd.sockets.nix-daemon.enable = false;
|
|
systemd.services.nix-daemon.enable = false;
|
|
};
|
|
}
|