vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move the c0re host options to deploy.hive-controller

Browse source
This commit is contained in:
atlas 2026-10-29 01:02:45 +01:00
commit 74f463c40e
1 changed files with 257 additions and 94 deletions
Download patch file Download diff file Expand all files Collapse all files

26
nix/host-modules/hive-c0re/default.nix
View file

@ -102,12 +102,12 @@ let
else
import ../../claude-code-no-alsa.nix lib controllerCfg.claudeCodePackage;
dashboard_port = controllerCfg.dashboardPort;
agent_cpu_quota = cfg.agentCpuQuota;
agent_memory_max = cfg.agentMemoryMax;
agent_cpu_weight = cfg.agentCpuWeight;
agent_io_weight = cfg.agentIoWeight;
model_prices = cfg.modelPrices;
build_slots = cfg.buildSlots;
agent_cpu_quota = controllerCfg.agentCpuQuota;
agent_memory_max = controllerCfg.agentMemoryMax;
agent_cpu_weight = controllerCfg.agentCpuWeight;
agent_io_weight = controllerCfg.agentIoWeight;
model_prices = controllerCfg.modelPrices;
build_slots = controllerCfg.buildSlots;
};
in
{
@ -167,11 +167,11 @@ in
];
environment.systemPackages = [
cfg.package
controllerCfg.package
pkgs.git
# XDG icons + .desktop entries so desktop environments can match
# hyperhive processes to their icon (task managers, CPU monitors, etc.).
cfg.xdgIcons
controllerCfg.xdgIcons
];
# Serve config at a stable /etc path so hive-c0re's ExecStart
@ -185,8 +185,8 @@ in
# builds them, they end up in /nix/store, and the first
# nixos-container update + start for an agent has nothing left to
# do. Gated because the closure is sizeable and pinned to x86_64.
system.extraDependencies = lib.optionals cfg.preBuildAgentTemplates [
cfg.agentBaseToplevel
system.extraDependencies = lib.optionals controllerCfg.preBuildAgentTemplates [
controllerCfg.agentBaseToplevel
];
# Unprivileged coordinator user. hive-c0re runs as this user;
@ -205,7 +205,7 @@ in
# hive control (spawn/kill/destroy/deploy, docs/trust-boundary/boundary.md), so this is
# an explicit opt-in allowlist — empty by default (root-only).
users.groups.hive-admin = {
members = cfg.adminUsers;
members = controllerCfg.adminUsers;
};
# Let `hive-admin` members run `hivectl agent <name> choom`
@ -259,7 +259,7 @@ in
];
environment = import ./environment.nix { inherit lib config pkgs; };
serviceConfig = {
ExecStart = "${cfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --config /etc/hyperhive/serve.json";
ExecStart = "${controllerCfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --config /etc/hyperhive/serve.json";
SyslogIdentifier = "hive-c0re";
# Migrate hive-c0re's *own* state to the service user after an
# upgrade from a root-run install (systemd's StateDirectory only
@ -378,7 +378,7 @@ in
# Must match the `--socket` arg passed to `hive-c0re serve`.
ListenStream = "/run/hyperhive/host.sock";
# `0660 root:hive-admin` — group-owned by `hive-admin` so operators in
# that group (services.hyperhive.c0re.adminUsers) drive `hivectl`
# that group (services.hyperhive.deploy.hive-controller.adminUsers) drive `hivectl`
# without root; an empty adminUsers list leaves the group memberless,
# so it stays effectively root-only. See docs/trust-boundary/boundary.md.
SocketMode = "0660";