vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

backendEnvironmentFile: use the harness dir, not state, per review

Browse source
This commit is contained in:
damocles 2026-08-26 23:40:49 +02:00 • committed by mara
commit 1aa35974ee
2 changed files with 18 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/agent-modules/agent-service.nix
View file

@ -131,7 +131,7 @@ in
options.hyperhive.backendEnvironmentFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "/agents/myagent/state/openrouter.env";
example = "/agents/myagent/harness/openrouter.env";
description = ''
Path (outside the nix store) to a systemd `EnvironmentFile` loaded
by the harness service — the mechanism for supplying
@ -148,11 +148,16 @@ in
ANTHROPIC_BASE_URL=https://openrouter.ai/api/v1
```
Place the file inside the agent's bind-mounted state dir (e.g.
`/agents/<name>/state/openrouter.env`) so it survives container
rebuilds; permissions should be `0600`, owned by the agent's unix
user. Loaded with a leading `-` (optional `EnvironmentFile`), so a
path that doesn't exist yet — an operator setting this option
Place the file inside the agent's bind-mounted **harness** dir (e.g.
`/agents/<name>/harness/openrouter.env`, `$HYPERHIVE_HARNESS_DIR`),
not `state/` — `harness/` survives container rebuilds exactly like
`state/` does, but is never bind-mounted into a parent agent's
container (unlike `state/`, which a parent gets read-write for child
recovery — see `docs/persistence.md`'s "Parent access to child
state"), so this credential is reachable by nothing but this agent
and the host. Permissions should be `0600`, owned by the agent's
unix user. Loaded with a leading `-` (optional `EnvironmentFile`),
so a path that doesn't exist yet — an operator setting this option
before creating the file, or a fresh host rebuild before state is
restored — makes systemd skip it rather than refuse to start the
harness. See `hyperhive.useApiKey`'s doc for the option this one is