vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the hive's local build of agent closures

Browse source 
A rebuild or create downloads the closure the swarm built and applies it; with none to deploy it fails and changes nothing. hive-priv takes a store path instead of an internal/meta commit and builds nothing.
This commit is contained in:
atlas 2026-10-29 22:17:07 +01:00
commit 4590b04cac
1 changed files with 632 additions and 1351 deletions
Download patch file Download diff file Expand all files Collapse all files

49
nix/host-modules/hive-priv.nix
View file

@ -9,22 +9,6 @@
}:
let
controllerCfg = config.services.hyperhive.deploy.hive-controller;
forgeGit = import ./lib/hive-forge-git.nix {
inherit pkgs;
forgeDomain = config.services.hyperhive.swarm.forge.domain;
};
# Same gitconfig as the c0re unit (see ./hive-c0re) apart from its stalled-
# transfer limit: hive-priv (root) runs nix, which fetches the hive-core-owned
# meta/applied repos (libgit2 refuses cross-user reads without
# safe.directory) and, from a fresh HOME, the forge inputs of `internal/meta`
# (the forge sections).
safeDirGitconfig = pkgs.writeText "hyperhive-safe-gitconfig" ''
[safe]
directory = *
${forgeGit.config}
'';
in
{
config = lib.mkIf config.services.hyperhive.deploy.hive-controller.enable {
@ -77,41 +61,25 @@ in
# findutils already in the default unit PATH. Without `nixos-container`
# on PATH every container op fails ENOENT, which `build_all` silently
# swallows into an empty list ("no managed containers").
#
# `nix` itself shells out by bare name too: `git` whenever it has to
# fetch/re-resolve a git-source flake input (an agent.nix with a
# `git+https://…` input, or a stale flake.lock whose node URL no longer
# matches the flake's declared input → nix re-resolves at eval), and
# `ssh` to dispatch to remote builders (`nix.buildMachines` /
# `ssh-ng://`). Without these on PATH `nixos-container update` dies with
# `executing "git": No such file or directory` / `Could not find
# executable 'ssh'` — the agent build fails before it starts.
path = [
pkgs.nixos-container
pkgs.nix # nix, nix-env, nix-instantiate — create + update
pkgs.gitMinimal # git — nix fetches/re-resolves git-source flake inputs
forgeGit.credentialHelper # git-credential-hive-forge — the forge's `git+http` inputs
pkgs.openssh # ssh — nix dispatches builds to remote builders
pkgs.util-linux # umount (nsenter is hardcoded in the script)
pkgs.e2fsprogs # chattr
pkgs.btrfs-progs # btrfs subvolume create/delete — Ensure/DeleteAgentSubvolume
];
environment = {
# `nixos-container update/create` runs `nix`, which writes its
# fetcher/eval cache under $HOME/.cache. With ProtectHome and no
# explicit HOME this lands on the unwritable /var/empty and Lix
# errors out. Point HOME at the StateDirectory below (persistent,
# so the cache survives across rebuilds).
# nix (`nix-env`, `nix-store`) writes its cache under $HOME/.cache.
# With ProtectHome and no explicit HOME this lands on the unwritable
# /var/empty and Lix errors out. Point HOME at the StateDirectory
# below (persistent, so the cache survives across restarts).
HOME = "/var/lib/hive-priv";
# hive-priv runs as root. Root nix defaults to store=auto which
# resolves to the LOCAL store — bypassing the host daemon, its
# remote builders, and prebuilt derivation outputs. Force daemon
# routing so nixos-container update and the nix prebuild see the
# same store and substituters as every other build context.
# routing so the closure `RealiseClosure` downloads is in the same
# store the container is then pointed at.
NIX_REMOTE = "daemon";
# The forge origin `internal/meta` is built from when a request names
# one of its commits. Fixed here; no request chooses it.
HIVE_PRIV_FORGE_URL = "http://${config.services.hyperhive.swarm.forge.domain}";
};
serviceConfig = {
ExecStart = "${controllerCfg.package}/bin/hive-priv";
@ -159,11 +127,6 @@ in
# Point the working directory at the writable StateDirectory so nix
# drops its temp symlink there instead.
WorkingDirectory = "/var/lib/hive-priv";
# nix (run here as root for `nixos-container update --flake
# /var/lib/hyperhive/meta#<agent>`) fetches the hive-core-owned
# meta/applied repos; libgit2 refuses them without safe.directory.
# See safeDirGitconfig above.
ExecStartPre = "+-${pkgs.coreutils}/bin/cp ${safeDirGitconfig} /var/lib/hive-priv/.gitconfig";
# Kernel surfaces neither hive-priv nor its children use: no
# personality(2), no real-time scheduling, no /dev/kmsg or
# /proc/kmsg, no explicit module loading (kernel-initiated autoload