vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

priv: derive flake ref from agent name; WriteNspawnFlags takes flags only

Browse source
This commit is contained in:
damocles 2026-06-01 17:15:06 +02:00 • committed by mara
commit 89d0937473
3 changed files with 64 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

62
hive-priv/src/main.rs
View file

@ -37,6 +37,10 @@ const SIBLING_CONTAINERS: &[&str] = &["hive-forge", "hive-matrix", "hive-gateway
/// Root of the per-agent unix-socket dirs on the host.
const SOCKET_DIR_ROOT: &str = "/run/hive-agent";
/// Host path of the meta flake (mirrors `meta::meta_dir()`).
/// The flake ref for agent `<name>` is `{META_DIR}#{name}`.
const META_DIR: &str = "/var/lib/hyperhive/meta";
#[tokio::main]
async fn main() -> Result<()> {
tracing_subscriber::fmt()
@ -163,16 +167,16 @@ async fn exec(req: PrivRequest) -> Result<(String, String)> {
container_run(&["kill", &container_system_name(name)]).await
}
PrivRequest::UpdateContainer { ref name, ref flake_ref } => {
PrivRequest::UpdateContainer { ref name } => {
validate_container_name(name)?;
validate_flake_ref(flake_ref)?;
container_run(&["update", &container_system_name(name), "--flake", flake_ref]).await
let flake_ref = agent_flake_ref(name);
container_run(&["update", &container_system_name(name), "--flake", &flake_ref]).await
}
PrivRequest::CreateContainer { ref name, ref flake_ref } => {
PrivRequest::CreateContainer { ref name } => {
validate_container_name(name)?;
validate_flake_ref(flake_ref)?;
container_run(&["create", &container_system_name(name), "--flake", flake_ref]).await
let flake_ref = agent_flake_ref(name);
container_run(&["create", &container_system_name(name), "--flake", &flake_ref]).await
}
PrivRequest::DestroyContainer { ref name } => {
@ -182,10 +186,9 @@ async fn exec(req: PrivRequest) -> Result<(String, String)> {
PrivRequest::ListContainers => container_run(&["list"]).await,
PrivRequest::WriteNspawnConf { ref container, ref content } => {
PrivRequest::WriteNspawnFlags { ref container, ref extra_nspawn_flags } => {
validate_container_system_name(container)?;
let path = format!("/etc/nixos-containers/{container}.conf");
std::fs::write(&path, content).with_context(|| format!("write {path}"))?;
write_nspawn_flags(container, extra_nspawn_flags)?;
Ok((String::new(), String::new()))
}
@ -354,9 +357,42 @@ fn validate_name_chars(name: &str) -> Result<()> {
Ok(())
}
fn validate_flake_ref(flake_ref: &str) -> Result<()> {
if flake_ref.is_empty() || flake_ref.contains('\n') || flake_ref.contains('\0') {
bail!("invalid flake_ref {flake_ref:?}");
/// Derive the meta-flake ref for an agent by name.
fn agent_flake_ref(name: &str) -> String {
format!("{META_DIR}#{name}")
}
/// Update `/etc/nixos-containers/<container>.conf`: strips network-isolation
/// vars (`PRIVATE_NETWORK`, `HOST_ADDRESS*`, `LOCAL_ADDRESS*`, `HOST_BRIDGE`,
/// `EXTRA_NSPAWN_FLAGS`), forces `PRIVATE_NETWORK=0` and blank network vars,
/// then appends `EXTRA_NSPAWN_FLAGS="<flags>"`.
fn write_nspawn_flags(container: &str, extra_nspawn_flags: &str) -> Result<()> {
let path = format!("/etc/nixos-containers/{container}.conf");
let original = std::fs::read_to_string(&path)
.with_context(|| format!("read {path}"))?;
let mut lines: Vec<&str> = original
.lines()
.filter(|line| {
let t = line.trim_start();
!t.starts_with("EXTRA_NSPAWN_FLAGS=")
&& !t.starts_with("PRIVATE_NETWORK=")
&& !t.starts_with("HOST_ADDRESS=")
&& !t.starts_with("LOCAL_ADDRESS=")
&& !t.starts_with("HOST_ADDRESS6=")
&& !t.starts_with("LOCAL_ADDRESS6=")
&& !t.starts_with("HOST_BRIDGE=")
})
.collect();
let mut out = lines.join("\n");
if !out.is_empty() {
out.push('\n');
}
Ok(())
out.push_str("PRIVATE_NETWORK=0\n");
out.push_str("HOST_ADDRESS=\n");
out.push_str("LOCAL_ADDRESS=\n");
out.push_str("HOST_ADDRESS6=\n");
out.push_str("LOCAL_ADDRESS6=\n");
out.push_str("HOST_BRIDGE=\n");
out.push_str(&format!("EXTRA_NSPAWN_FLAGS=\"{extra_nspawn_flags}\"\n"));
std::fs::write(&path, out).with_context(|| format!("write {path}"))
}