From 8d5e97ce9fe2d24a9378c726cd705cb6dd4f386c Mon Sep 17 00:00:00 2001 From: damocles Date: Mon, 1 Jun 2026 17:05:31 +0200 Subject: [PATCH] fix(702): update priv_client to match narrowed PrivRequest variants --- hive-c0re/src/priv_client.rs | 147 +++++++++++++++++------------------ 1 file changed, 72 insertions(+), 75 deletions(-) diff --git a/hive-c0re/src/priv_client.rs b/hive-c0re/src/priv_client.rs index 51a3b646..04a3e935 100644 --- a/hive-c0re/src/priv_client.rs +++ b/hive-c0re/src/priv_client.rs @@ -1,16 +1,10 @@ //! Async client for the `hive-priv` privileged-helper socket. //! -//! Exposes a standalone async function per operation that callers in -//! `lifecycle`, `forge`, `matrix`, and `gateway_nginx` can call -//! without carrying any client state. Each call opens a fresh connection -//! to `/run/hive/priv.sock`, sends one JSON line, reads the response, -//! and closes the connection. -//! -//! Connection-per-call is intentional: priv calls are infrequent (one -//! per rebuild step), so the simplicity is worth more than a persistent -//! connection. - -use std::path::{Path, PathBuf}; +//! Exposes a standalone async function per operation. Each call opens a +//! fresh connection to `/run/hive/priv.sock`, sends one JSON line, reads +//! the response, and closes. Connection-per-call is intentional: priv +//! calls are infrequent (once per rebuild step), so simplicity wins over +//! a persistent connection. use anyhow::{Context as _, Result, bail}; use hive_sh4re::priv_proto::{PRIV_SOCK, PrivRequest, PrivResponse}; @@ -36,95 +30,98 @@ pub async fn call(req: &PrivRequest) -> Result { serde_json::from_str(&resp_line).context("parse PrivResponse") } -/// Run `nixos-container `. -/// -/// On success returns `(stdout, stderr)`. -pub async fn container_run(args: Vec) -> Result<(String, String)> { - let resp = call(&PrivRequest::ContainerRun { args }).await?; - check(resp) +pub async fn start_container(name: &str) -> Result<()> { + ok(call(&PrivRequest::StartContainer { name: name.to_owned() }).await?) } -/// Run `systemctl daemon-reload`. -pub async fn daemon_reload() -> Result<()> { - let resp = call(&PrivRequest::DaemonReload).await?; - check(resp)?; - Ok(()) +pub async fn stop_container(name: &str) -> Result<()> { + ok(call(&PrivRequest::StopContainer { name: name.to_owned() }).await?) +} + +pub async fn kill_container(name: &str) -> Result<()> { + ok(call(&PrivRequest::KillContainer { name: name.to_owned() }).await?) +} + +pub async fn update_container(name: &str, flake_ref: &str) -> Result<(String, String)> { + check(call(&PrivRequest::UpdateContainer { + name: name.to_owned(), + flake_ref: flake_ref.to_owned(), + }).await?) +} + +pub async fn create_container(name: &str, flake_ref: &str) -> Result<(String, String)> { + check(call(&PrivRequest::CreateContainer { + name: name.to_owned(), + flake_ref: flake_ref.to_owned(), + }).await?) +} + +pub async fn destroy_container(name: &str) -> Result<()> { + ok(call(&PrivRequest::DestroyContainer { name: name.to_owned() }).await?) +} + +pub async fn list_containers() -> Result { + let (stdout, _) = check(call(&PrivRequest::ListContainers).await?)?; + Ok(stdout) } -/// Overwrite `/etc/nixos-containers/.conf`. pub async fn write_nspawn_conf(container: &str, content: &str) -> Result<()> { - let resp = call(&PrivRequest::WriteNspawnConf { + ok(call(&PrivRequest::WriteNspawnConf { container: container.to_owned(), content: content.to_owned(), - }) - .await?; - check(resp)?; - Ok(()) + }).await?) } -/// Write a systemd drop-in file for `container@.service`. -pub async fn write_systemd_dropin(container: &str, filename: &str, content: &str) -> Result<()> { - let resp = call(&PrivRequest::WriteSystemdDropin { +pub async fn write_resource_limits( + container: &str, + memory_max: &str, + cpu_quota: &str, +) -> Result<()> { + ok(call(&PrivRequest::WriteResourceLimits { container: container.to_owned(), - filename: filename.to_owned(), - content: content.to_owned(), - }) - .await?; - check(resp)?; - Ok(()) + memory_max: memory_max.to_owned(), + cpu_quota: cpu_quota.to_owned(), + }).await?) } -/// Remove the systemd drop-in dir for `container@.service`. -pub async fn remove_systemd_dropin(container: &str) -> Result<()> { - let resp = call(&PrivRequest::RemoveSystemdDropin { +pub async fn remove_service_dropin(container: &str) -> Result<()> { + ok(call(&PrivRequest::RemoveServiceDropin { container: container.to_owned(), - }) - .await?; - check(resp)?; - Ok(()) + }).await?) } -/// `chown(path, uid, gid)` via hive-priv. -/// -/// `path` must be under `/run/hive-agent/` or `/var/lib/hyperhive/`. -pub async fn chown(path: &Path, uid: u32, gid: u32) -> Result<()> { - let resp = call(&PrivRequest::Chown { - path: PathBuf::from(path), +pub async fn daemon_reload() -> Result<()> { + ok(call(&PrivRequest::DaemonReload).await?) +} + +pub async fn reload_gateway_nginx() -> Result<()> { + ok(call(&PrivRequest::ReloadGatewayNginx).await?) +} + +pub async fn chown_socket_dir(agent_name: &str, uid: u32, gid: u32) -> Result<()> { + ok(call(&PrivRequest::ChownSocketDir { + agent_name: agent_name.to_owned(), uid, gid, - }) - .await?; - check(resp)?; - Ok(()) + }).await?) } -/// `chmod(path, mode)` via hive-priv. -/// -/// `path` must be under `/run/hive-agent/` or `/var/lib/hyperhive/`. -pub async fn chmod(path: &Path, mode: u32) -> Result<()> { - let resp = call(&PrivRequest::Chmod { - path: PathBuf::from(path), +pub async fn chmod_socket_dir(agent_name: &str, mode: u32) -> Result<()> { + ok(call(&PrivRequest::ChmodSocketDir { + agent_name: agent_name.to_owned(), mode, - }) - .await?; - check(resp)?; - Ok(()) -} - -/// Reload nginx inside `hive-gateway` via `systemd-run --machine`. -pub async fn reload_gateway_nginx() -> Result<()> { - let resp = call(&PrivRequest::ReloadGatewayNginx).await?; - check(resp)?; - Ok(()) + }).await?) } fn check(resp: PrivResponse) -> Result<(String, String)> { if resp.ok { Ok((resp.stdout, resp.stderr)) } else { - bail!( - "{}", - resp.error.as_deref().unwrap_or("hive-priv returned error") - ) + bail!("{}", resp.error.as_deref().unwrap_or("hive-priv returned error")) } } + +fn ok(resp: PrivResponse) -> Result<()> { + check(resp)?; + Ok(()) +}