vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move the c0re host options to deploy.hive-controller

Browse source
This commit is contained in:
atlas 2026-10-29 01:02:45 +01:00
commit 74f463c40e
5 changed files with 257 additions and 94 deletions
Download patch file Download diff file Expand all files Collapse all files

26
nix/host-modules/hive-c0re/default.nix
View file

@ -102,12 +102,12 @@ let
else
import ../../claude-code-no-alsa.nix lib controllerCfg.claudeCodePackage;
dashboard_port = controllerCfg.dashboardPort;
agent_cpu_quota = cfg.agentCpuQuota;
agent_memory_max = cfg.agentMemoryMax;
agent_cpu_weight = cfg.agentCpuWeight;
agent_io_weight = cfg.agentIoWeight;
model_prices = cfg.modelPrices;
build_slots = cfg.buildSlots;
agent_cpu_quota = controllerCfg.agentCpuQuota;
agent_memory_max = controllerCfg.agentMemoryMax;
agent_cpu_weight = controllerCfg.agentCpuWeight;
agent_io_weight = controllerCfg.agentIoWeight;
model_prices = controllerCfg.modelPrices;
build_slots = controllerCfg.buildSlots;
};
in
{
@ -167,11 +167,11 @@ in
];
environment.systemPackages = [
cfg.package
controllerCfg.package
pkgs.git
# XDG icons + .desktop entries so desktop environments can match
# hyperhive processes to their icon (task managers, CPU monitors, etc.).
cfg.xdgIcons
controllerCfg.xdgIcons
];
# Serve config at a stable /etc path so hive-c0re's ExecStart
@ -185,8 +185,8 @@ in
# builds them, they end up in /nix/store, and the first
# nixos-container update + start for an agent has nothing left to
# do. Gated because the closure is sizeable and pinned to x86_64.
system.extraDependencies = lib.optionals cfg.preBuildAgentTemplates [
cfg.agentBaseToplevel
system.extraDependencies = lib.optionals controllerCfg.preBuildAgentTemplates [
controllerCfg.agentBaseToplevel
];
# Unprivileged coordinator user. hive-c0re runs as this user;
@ -205,7 +205,7 @@ in
# hive control (spawn/kill/destroy/deploy, docs/trust-boundary/boundary.md), so this is
# an explicit opt-in allowlist — empty by default (root-only).
users.groups.hive-admin = {
members = cfg.adminUsers;
members = controllerCfg.adminUsers;
};
# Let `hive-admin` members run `hivectl agent <name> choom`
@ -259,7 +259,7 @@ in
];
environment = import ./environment.nix { inherit lib config pkgs; };
serviceConfig = {
ExecStart = "${cfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --config /etc/hyperhive/serve.json";
ExecStart = "${controllerCfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --config /etc/hyperhive/serve.json";
SyslogIdentifier = "hive-c0re";
# Migrate hive-c0re's *own* state to the service user after an
# upgrade from a root-run install (systemd's StateDirectory only
@ -378,7 +378,7 @@ in
# Must match the `--socket` arg passed to `hive-c0re serve`.
ListenStream = "/run/hyperhive/host.sock";
# `0660 root:hive-admin` — group-owned by `hive-admin` so operators in
# that group (services.hyperhive.c0re.adminUsers) drive `hivectl`
# that group (services.hyperhive.deploy.hive-controller.adminUsers) drive `hivectl`
# without root; an empty adminUsers list leaves the group memberless,
# so it stays effectively root-only. See docs/trust-boundary/boundary.md.
SocketMode = "0660";

4
nix/host-modules/hive-c0re/environment.nix
View file

@ -8,7 +8,7 @@
pkgs,
}:
let
cfg = config.services.hyperhive.c0re;
controllerCfg = config.services.hyperhive.deploy.hive-controller;
baoDeploy = config.services.hyperhive.deploy.bao;
baoCfg = config.services.hyperhive.swarm.bao;
# A reader is defined by holding a certificate the store accepts, not by
@ -64,7 +64,7 @@ in
# nix store directly; dynamic API paths still proxied to the
# agent daemon. nginx runs on the host, which is where this
# store path already is, so it is reachable as written.
HIVE_AGENT_FRONTEND_DIR = "${cfg.servedFrontend}/agent";
HIVE_AGENT_FRONTEND_DIR = "${controllerCfg.servedFrontend}/agent";
}
// {
# Identity env vars threaded into c0re's own service env and

70
nix/host-modules/hive-c0re/options.nix
View file

@ -1,11 +1,12 @@
# Option declarations for `services.hyperhive.c0re.*` — the c0re
# daemon's knobs plus the package/source options the flake's
# `nixosModules.default` wires to its own outputs (they carry no
# in-module defaults; see ../../../flake.nix). The read-only
# Option declarations for the c0re daemon. `services.hyperhive.c0re.*`
# keeps the two flake-source options the swarm builder also reads
# (`hyperhiveFlake`, `nixpkgsFlake`); every other knob and the
# package/asset options the flake's `nixosModules.default` wires to its
# own outputs (they carry no in-module defaults; see ../../../flake.nix)
# live under `services.hyperhive.deploy.hive-controller`, alongside the
# values the meta-flake render hands the hive's agents. The read-only
# `servedFrontend` option lives in ./theme.nix with the stylix wiring
# that computes it. The hive's own values the meta-flake render hands
# its agents are declared here too, under
# `services.hyperhive.deploy.hive-controller`.
# that computes it.
{
pkgs,
lib,
@ -23,6 +24,33 @@
];
options.services.hyperhive.c0re = {
hyperhiveFlake = lib.mkOption {
type = lib.types.str;
defaultText = lib.literalMD "the hyperhive flake's own filtered source store path";
description = ''
Store path of the hyperhive flake source (no fragment). hive-c0re
reads it to tell which revision is running, and the swarm builder
builds on it. Wired by `nixosModules.default` to this flake's own
filtered source.
'';
};
nixpkgsFlake = lib.mkOption {
type = lib.types.str;
default = "path:${pkgs.path}";
defaultText = lib.literalMD "`\"path:\${pkgs.path}\"`";
description = ''
Store-path URL of the nixpkgs the swarm builder's check flake
builds on. The swarm meta flake does not use it: its `nixpkgs`
follows `hyperhive/nixpkgs`.
Defaults to `"path:''${pkgs.path}"`, the nixpkgs the host NixOS
module was evaluated with.
'';
};
};
# The hive-controller's deployment options.
options.services.hyperhive.deploy.hive-controller = {
package = lib.mkOption {
type = lib.types.package;
defaultText = lib.literalExpression "hyperhive.packages.\${system}.default";
@ -71,16 +99,6 @@
processes to their icon.
'';
};
hyperhiveFlake = lib.mkOption {
type = lib.types.str;
defaultText = lib.literalMD "the hyperhive flake's own filtered source store path";
description = ''
Store path of the hyperhive flake source (no fragment). hive-c0re
reads it to tell which revision is running, and the swarm builder
builds on it. Wired by `nixosModules.default` to this flake's own
filtered source.
'';
};
hyperhiveRev = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
@ -105,19 +123,6 @@
enabled.
'';
};
nixpkgsFlake = lib.mkOption {
type = lib.types.str;
default = "path:${pkgs.path}";
defaultText = lib.literalMD "`\"path:\${pkgs.path}\"`";
description = ''
Store-path URL of the nixpkgs the swarm builder's check flake
builds on. The swarm meta flake does not use it: its `nixpkgs`
follows `hyperhive/nixpkgs`.
Defaults to `"path:''${pkgs.path}"`, the nixpkgs the host NixOS
module was evaluated with.
'';
};
preBuildAgentTemplates = lib.mkOption {
type = lib.types.bool;
default = false;
@ -325,12 +330,7 @@
socket root-only, as before.
'';
};
};
# What this hive hands its own agents at container start, through
# `/etc/hyperhive-hive-facts`. Per host, so two hives may set them
# differently.
options.services.hyperhive.deploy.hive-controller = {
claudeCodePackage = lib.mkOption {
type = lib.types.nullOr lib.types.package;
default = null;

6
nix/host-modules/hive-c0re/theme.nix
View file

@ -6,7 +6,7 @@
# the entire swap contract — `theme.css` derives every semantic var
# from the 16 base16 slots (see docs/web-ui/css-vars.md). The guarded
# access makes this a clean no-op when stylix isn't imported into the
# host config. Exposed as the read-only `c0re.servedFrontend` option.
# host config. Exposed as the read-only `deploy.hive-controller.servedFrontend` option.
#
# Detection + CSS-generation itself lives in `../stylix-theme.nix`
# (shared with `swarm-ui.nix`) — this file is the c0re-specific overlay
@ -18,7 +18,7 @@
...
}:
let
cfg = config.services.hyperhive.c0re;
cfg = config.services.hyperhive.deploy.hive-controller;
stylixTheme = import ../stylix-theme.nix { inherit lib config pkgs; };
inherit (stylixTheme) stylixThemeColors themedColorsCss;
# Overlay the generated colors.css onto both dist subtrees. Both the
@ -42,7 +42,7 @@ let
'';
in
{
options.services.hyperhive.c0re.servedFrontend = lib.mkOption {
options.services.hyperhive.deploy.hive-controller.servedFrontend = lib.mkOption {
type = lib.types.package;
internal = true;
readOnly = true;

2
nix/host-modules/hive-c0re/vhosts.nix
View file

@ -17,7 +17,7 @@ let
inherit (gatewayCfg.lib) errorPages;
# Dashboard SPA dist, static-served by nginx.
dashboardDist = "${hyperhiveCfg.c0re.servedFrontend}/dashboard";
dashboardDist = "${hyperhiveCfg.deploy.hive-controller.servedFrontend}/dashboard";
# `/agent/` catch-all 404 + the two internal error-page targets it
# points at. Per-agent `location /agent/<name>/` blocks live in the