vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move dashboardPort, claudeCodePackage and extraResourceAttributes to deploy.hive-controller

Browse source 
These three are per-host choices that hive-c0re reads and renders into
its agents, so they belong under the hive controller's deploy namespace
rather than swarm-wide:

- c0re.dashboardPort -> deploy.hive-controller.dashboardPort
- c0re.claudeCodePackage -> deploy.hive-controller.claudeCodePackage
  (the claude-login and review-classifier containers on the same host
  keep following it)
- otel.extraResourceAttributes -> deploy.hive-controller.otel.extraResourceAttributes

The old paths stay as mkRenamedOptionModule aliases, now in deploy.nix
with the namespace's other renames. github.enable and the collector port
stay swarm-wide.
This commit is contained in:
atlas 2026-10-17 12:52:24 +02:00 • committed by mara
commit 5bb9d7c7e5
21 changed files with 92 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/agent-modules/default.nix
View file

@ -96,7 +96,7 @@ in
nixpkgs.
Set by the generated meta flake when the operator sets
`services.hyperhive.swarm.claudeCodePackage` host-side, so a swarm
`services.hyperhive.deploy.hive-controller.claudeCodePackage` host-side, so a hive
can run a claude built from a *different* nixpkgs than the one
its agents evaluate against — a release channel can trail
unstable by weeks on this one package. It arrives as a path and
@ -109,7 +109,7 @@ in
there is only ever one claude in the container. Note that neither
the symlink nor anything else in the container's closure *refers*
to the target — keeping it alive is the host's job, see
`services.hyperhive.swarm.claudeCodePackage`.
`services.hyperhive.deploy.hive-controller.claudeCodePackage`.
'';
};
@ -255,7 +255,7 @@ in
# The symlink registers no store reference — the target isn't
# among this derivation's inputs, so nothing here keeps the
# binary alive. That is deliberate and it is the host's job:
# see `services.hyperhive.swarm.claudeCodePackage`.
# see `services.hyperhive.deploy.hive-controller.claudeCodePackage`.
pkgs.runCommandLocal "claude-code-pinned" { } ''
mkdir -p "$out/bin"
ln -s ${config.services.hyperhive.agent.claudeCodePath}/bin/claude "$out/bin/claude"

3
nix/agent-modules/otel.nix
View file

@ -125,7 +125,8 @@ in
Extra comma-separated entries appended to
`OTEL_RESOURCE_ATTRIBUTES` after the built-in
`service.name` / `agent` / `swarm` labels.
Host-driven via `services.hyperhive.swarm.hiveOtel.extraResourceAttributes`.
Host-driven via
`services.hyperhive.deploy.hive-controller.otel.extraResourceAttributes`.
'';
};

15
nix/host-modules/deploy.nix
View file

@ -112,6 +112,21 @@ in
[ "services" "hyperhive" "deploy" "bao" "servicesIssuerClientKeyFile" ]
)
# What hive-c0re hands this hive's agents: a per-host choice, so it
# sits with the controller's other deployment options.
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "c0re" "claudeCodePackage" ]
[ "services" "hyperhive" "deploy" "hive-controller" "claudeCodePackage" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "c0re" "dashboardPort" ]
[ "services" "hyperhive" "deploy" "hive-controller" "dashboardPort" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "otel" "extraResourceAttributes" ]
[ "services" "hyperhive" "deploy" "hive-controller" "otel" "extraResourceAttributes" ]
)
# The homeserver's port and its firewall switch, removed rather than
# renamed: tuwunel listens on a unix socket only the gateway reaches, so
# there is no host port to choose or open.

12
nix/host-modules/hive-c0re/default.nix
View file

@ -12,7 +12,7 @@
}:
let
cfg = config.services.hyperhive.c0re;
swarmCfg = config.services.hyperhive.swarm;
controllerCfg = config.services.hyperhive.deploy.hive-controller;
# `/run/hyperhive`'s mode. Held in one place because whichever of the two
# units below activates first creates the directory, so they cannot be
@ -111,8 +111,8 @@ let
# anything that drops it. The failure mode is a garbage-collected
# `claude` and a hive that can't take a turn, weeks after the commit
# that caused it.
claude_code_path = swarmCfg.claudeCodePackage;
dashboard_port = swarmCfg.dashboardPort;
claude_code_path = controllerCfg.claudeCodePackage;
dashboard_port = controllerCfg.dashboardPort;
agent_cpu_quota = cfg.agentCpuQuota;
agent_memory_max = cfg.agentMemoryMax;
agent_cpu_weight = cfg.agentCpuWeight;
@ -164,10 +164,10 @@ in
# `claude`, at whatever unrelated moment the gc runs. Cheap
# enough to just check.
assertion =
swarmCfg.claudeCodePackage == null
|| builtins.hasContext (builtins.toJSON swarmCfg.claudeCodePackage);
controllerCfg.claudeCodePackage == null
|| builtins.hasContext (builtins.toJSON controllerCfg.claudeCodePackage);
message = ''
services.hyperhive.swarm.claudeCodePackage lost its store
services.hyperhive.deploy.hive-controller.claudeCodePackage lost its store
context on the way into /etc/hyperhive/serve.json, so the
package is no longer gc-rooted by the system closure and
`nix-collect-garbage` may delete the claude every agent runs.

11
nix/host-modules/hive-c0re/environment.nix
View file

@ -72,15 +72,16 @@ in
HYPERHIVE_GITHUB_DISABLED = "1";
}
// lib.optionalAttrs config.services.hyperhive.otel.enable (
# OTEL config (`swarm.hiveOtel`, gated on this hive's `otel.enable`) ->
# read by meta.rs::otel_config and injected as build-time
# `services.hyperhive.agent.otel.*` into every agent.
# OTEL config (`swarm.hiveOtel`, `deploy.hive-controller.otel`, gated on
# this hive's `otel.enable`) -> read by meta.rs::otel_config and injected
# as build-time `services.hyperhive.agent.otel.*` into every agent.
# Endpoint presence is the enable signal on the meta side; the
# optional fields are only emitted when set so absent values
# don't render no-op env lines.
let
otel = config.services.hyperhive.otel;
hiveOtel = config.services.hyperhive.swarm.hiveOtel;
controllerOtel = config.services.hyperhive.deploy.hive-controller.otel;
# The first hop, this hive's own collector, under the two spellings its
# two kinds of caller need. Agents get the swarm-wide name, so their
# builds carry nothing hive-specific; this daemon gets the bridge
@ -115,8 +116,8 @@ in
# what has to honour it (see nix/host-modules/otel.nix).
HYPERHIVE_OTEL_PROTOCOL = "http/protobuf";
}
// lib.optionalAttrs (hiveOtel.extraResourceAttributes != "") {
HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES = hiveOtel.extraResourceAttributes;
// lib.optionalAttrs (controllerOtel.extraResourceAttributes != "") {
HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES = controllerOtel.extraResourceAttributes;
}
# HYPERHIVE_OTEL_HEADERS_CREDENTIAL is deliberately NOT emitted, and
# its absence is the security half of this design: that variable would

28
nix/host-modules/hive-c0re/options.nix
View file

@ -3,29 +3,19 @@
# `nixosModules.default` wires to its own outputs (they carry no
# in-module defaults; see ../../../flake.nix). The read-only
# `servedFrontend` option lives in ./theme.nix with the stylix wiring
# that computes it. The swarm-wide values the meta-flake render hands
# every agent are declared here too, under `services.hyperhive.swarm`.
# that computes it. The hive's own values the meta-flake render hands
# its agents are declared here too, under
# `services.hyperhive.deploy.hive-controller`.
{
pkgs,
lib,
...
}:
let
renamedToSwarm =
name:
lib.mkRenamedOptionModule
[ "services" "hyperhive" "c0re" name ]
[ "services" "hyperhive" "swarm" name ];
in
{
imports = [
(lib.mkRemovedOptionModule [ "services" "hyperhive" "c0re" "managerToplevel" ] ''
Every agent, ruth included, builds from `agentBaseToplevel`. Remove this definition.
'')
]
++ map renamedToSwarm [
"claudeCodePackage"
"dashboardPort"
];
options.services.hyperhive.c0re = {
@ -340,19 +330,19 @@ in
};
};
# What every agent in the swarm is handed through the meta-flake render,
# whichever hive builds it. Swarm-wide so that no hive's agents differ.
options.services.hyperhive.swarm = {
# What this hive hands its own agents through the meta-flake render. Per
# host, so two hives may set them differently.
options.services.hyperhive.deploy.hive-controller = {
claudeCodePackage = lib.mkOption {
type = lib.types.nullOr lib.types.package;
default = null;
example = lib.literalExpression "inputs.nixpkgs-unstable.legacyPackages.x86_64-linux.claude-code";
description = ''
The `claude-code` build every agent runs, or `null` (the
The `claude-code` build every agent on this hive runs, or `null` (the
default) to leave each agent on the `claude-code` from its own
nixpkgs — i.e. whatever `c0re.nixpkgsFlake` resolves to.
This is the one binary the whole swarm is built around, and it
This is the one binary the whole hive is built around, and it
moves fast enough that a release channel routinely trails
unstable by weeks on it. An agent cannot fix that for itself:
agents evaluate against the single nixpkgs hive-c0re injects,
@ -391,7 +381,7 @@ in
dashboardPort = lib.mkOption {
type = lib.types.port;
default = 7000;
description = "TCP port every hive's hive-c0re dashboard listens on.";
description = "TCP port this hive's hive-c0re dashboard listens on.";
};
};
}

2
nix/host-modules/hive-gateway/options.nix
View file

@ -62,7 +62,7 @@ in
description = ''
TCP port the gateway proxies non-static requests to. Defaults
to `7000` (hive-c0re's out-of-the-box dashboard port). Operators
who change `services.hyperhive.swarm.dashboardPort` should set
who change `services.hyperhive.deploy.hive-controller.dashboardPort` should set
`upstreamPort` to match — kept as a hardcoded default rather
than a cross-reference to keep this module's options eval
independent of c0re's option tree shape.

28
nix/host-modules/otel.nix
View file

@ -61,10 +61,6 @@ in
[ "services" "hyperhive" "otel" "collector" "port" ]
[ "services" "hyperhive" "swarm" "hiveOtel" "collectorPort" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "otel" "extraResourceAttributes" ]
[ "services" "hyperhive" "swarm" "hiveOtel" "extraResourceAttributes" ]
)
];
options.services.hyperhive.otel = {
@ -279,7 +275,7 @@ in
};
# Shared by every hive's otel tier and its agents, so an agent's build
# carries the same values whichever hive renders it.
# carries the same port whichever hive renders it.
options.services.hyperhive.swarm.hiveOtel = {
collectorPort = lib.mkOption {
type = lib.types.port;
@ -296,17 +292,19 @@ in
containers and not from the outside world.
'';
};
};
extraResourceAttributes = lib.mkOption {
type = lib.types.str;
default = "";
example = "deployment.environment=prod";
description = ''
Extra comma-separated entries appended to
`OTEL_RESOURCE_ATTRIBUTES` after the built-in
`service.name` / `agent` / `hive` / `swarm` labels.
'';
};
# Read by this hive's hive-c0re, which stamps it on its own export and
# renders it into its agents', so it is a per-host choice.
options.services.hyperhive.deploy.hive-controller.otel.extraResourceAttributes = lib.mkOption {
type = lib.types.str;
default = "";
example = "deployment.environment=prod";
description = ''
Extra comma-separated entries appended to
`OTEL_RESOURCE_ATTRIBUTES` of this hive's hive-c0re and its agents,
after the built-in `service.name` / `agent` / `hive` / `swarm` labels.
'';
};
config = lib.mkIf config.services.hyperhive.otel.enable (

6
nix/host-modules/swarm-claude-login.nix
View file

@ -23,12 +23,12 @@ let
hyperhiveCfg = config.services.hyperhive;
# The `claude-code` the agents run, so this container does not trail them on
# the CLI; `fallback`, the container's own nixpkgs', only where the swarm pins
# the CLI; `fallback`, the container's own nixpkgs', only where this host pins
# none.
claudeCode =
fallback:
if hyperhiveCfg.swarm.claudeCodePackage != null then
hyperhiveCfg.swarm.claudeCodePackage
if hyperhiveCfg.deploy.hive-controller.claudeCodePackage != null then
hyperhiveCfg.deploy.hive-controller.claudeCodePackage
else
fallback;
cfg = hyperhiveCfg.deploy.claude-login;

6
nix/host-modules/swarm-review-classifier.nix
View file

@ -24,12 +24,12 @@ let
hyperhiveCfg = config.services.hyperhive;
# The `claude-code` the agents run, so this container does not trail them on
# the CLI; `fallback`, the container's own nixpkgs', only where the swarm pins
# the CLI; `fallback`, the container's own nixpkgs', only where this host pins
# none.
claudeCode =
fallback:
if hyperhiveCfg.swarm.claudeCodePackage != null then
hyperhiveCfg.swarm.claudeCodePackage
if hyperhiveCfg.deploy.hive-controller.claudeCodePackage != null then
hyperhiveCfg.deploy.hive-controller.claudeCodePackage
else
fallback;
cfg = hyperhiveCfg.deploy.review-classifier;

6
nix/module-eval/swarm-services-switch.nix
View file

@ -99,11 +99,11 @@ let
deploy.builder.enable = false;
};
# Same, with the claude-code build the agents run pinned for the swarm. Any
# Same, with the claude-code build the agents run pinned on this host. Any
# package serves: only the path the containers are pointed at is read.
swarmServicesPinnedClaude = hiveWithController {
deploy.allSwarmServices = true;
swarm.claudeCodePackage = pkgs.hello;
deploy.hive-controller.claudeCodePackage = pkgs.hello;
};
# Same, with one of those services placed on another host. Every derivation
@ -284,7 +284,7 @@ let
# The CLI is the one the agents run, not the container's own nixpkgs'.
# Unpinned is the control: it falls back to the container's own `claude-code`.
# serve.json is what hive-c0re renders every agent's `claudeCodePath` from.
name = "the agents, the claude login minter and the review classifier run the claude-code the swarm pins";
name = "the agents, the claude login minter and the review classifier run the claude-code this host pins";
ok =
let
claudeOf =