fix(702): update priv_client to match narrowed PrivRequest variants

hive-c0re/src/priv_client.rs

@@ -1,16 +1,10 @@
 //! Async client for the `hive-priv` privileged-helper socket.
 //!
-//! Exposes a standalone async function per operation that callers in
+//! Exposes a standalone async function per operation. Each call opens a
-//! `lifecycle`, `forge`, `matrix`, and `gateway_nginx` can call
+//! fresh connection to `/run/hive/priv.sock`, sends one JSON line, reads
-//! without carrying any client state. Each call opens a fresh connection
+//! the response, and closes. Connection-per-call is intentional: priv
-//! to `/run/hive/priv.sock`, sends one JSON line, reads the response,
+//! calls are infrequent (once per rebuild step), so simplicity wins over
-//! and closes the connection.
+//! a persistent connection.
-//!
-//! Connection-per-call is intentional: priv calls are infrequent (one
-//! per rebuild step), so the simplicity is worth more than a persistent
-//! connection.
-
-use std::path::{Path, PathBuf};
 
 use anyhow::{Context as _, Result, bail};
 use hive_sh4re::priv_proto::{PRIV_SOCK, PrivRequest, PrivResponse};
@@ -36,95 +30,98 @@ pub async fn call(req: &PrivRequest) -> Result<PrivResponse> {
     serde_json::from_str(&resp_line).context("parse PrivResponse")
 }
 
-/// Run `nixos-container <args>`.
+pub async fn start_container(name: &str) -> Result<()> {
-///
+    ok(call(&PrivRequest::StartContainer { name: name.to_owned() }).await?)
-/// On success returns `(stdout, stderr)`.
-pub async fn container_run(args: Vec<String>) -> Result<(String, String)> {
-    let resp = call(&PrivRequest::ContainerRun { args }).await?;
-    check(resp)
 }
 
-/// Run `systemctl daemon-reload`.
+pub async fn stop_container(name: &str) -> Result<()> {
-pub async fn daemon_reload() -> Result<()> {
+    ok(call(&PrivRequest::StopContainer { name: name.to_owned() }).await?)
-    let resp = call(&PrivRequest::DaemonReload).await?;
+}
-    check(resp)?;
+
-    Ok(())
+pub async fn kill_container(name: &str) -> Result<()> {
+    ok(call(&PrivRequest::KillContainer { name: name.to_owned() }).await?)
+}
+
+pub async fn update_container(name: &str, flake_ref: &str) -> Result<(String, String)> {
+    check(call(&PrivRequest::UpdateContainer {
+        name: name.to_owned(),
+        flake_ref: flake_ref.to_owned(),
+    }).await?)
+}
+
+pub async fn create_container(name: &str, flake_ref: &str) -> Result<(String, String)> {
+    check(call(&PrivRequest::CreateContainer {
+        name: name.to_owned(),
+        flake_ref: flake_ref.to_owned(),
+    }).await?)
+}
+
+pub async fn destroy_container(name: &str) -> Result<()> {
+    ok(call(&PrivRequest::DestroyContainer { name: name.to_owned() }).await?)
+}
+
+pub async fn list_containers() -> Result<String> {
+    let (stdout, _) = check(call(&PrivRequest::ListContainers).await?)?;
+    Ok(stdout)
 }
 
-/// Overwrite `/etc/nixos-containers/<container>.conf`.
 pub async fn write_nspawn_conf(container: &str, content: &str) -> Result<()> {
-    let resp = call(&PrivRequest::WriteNspawnConf {
+    ok(call(&PrivRequest::WriteNspawnConf {
         container: container.to_owned(),
         content: content.to_owned(),
-    })
+    }).await?)
-    .await?;
-    check(resp)?;
-    Ok(())
 }
 
-/// Write a systemd drop-in file for `container@<container>.service`.
+pub async fn write_resource_limits(
-pub async fn write_systemd_dropin(container: &str, filename: &str, content: &str) -> Result<()> {
+    container: &str,
-    let resp = call(&PrivRequest::WriteSystemdDropin {
+    memory_max: &str,
+    cpu_quota: &str,
+) -> Result<()> {
+    ok(call(&PrivRequest::WriteResourceLimits {
         container: container.to_owned(),
-        filename: filename.to_owned(),
+        memory_max: memory_max.to_owned(),
-        content: content.to_owned(),
+        cpu_quota: cpu_quota.to_owned(),
-    })
+    }).await?)
-    .await?;
-    check(resp)?;
-    Ok(())
 }
 
-/// Remove the systemd drop-in dir for `container@<container>.service`.
+pub async fn remove_service_dropin(container: &str) -> Result<()> {
-pub async fn remove_systemd_dropin(container: &str) -> Result<()> {
+    ok(call(&PrivRequest::RemoveServiceDropin {
-    let resp = call(&PrivRequest::RemoveSystemdDropin {
         container: container.to_owned(),
-    })
+    }).await?)
-    .await?;
-    check(resp)?;
-    Ok(())
 }
 
-/// `chown(path, uid, gid)` via hive-priv.
+pub async fn daemon_reload() -> Result<()> {
-///
+    ok(call(&PrivRequest::DaemonReload).await?)
-/// `path` must be under `/run/hive-agent/` or `/var/lib/hyperhive/`.
+}
-pub async fn chown(path: &Path, uid: u32, gid: u32) -> Result<()> {
+
-    let resp = call(&PrivRequest::Chown {
+pub async fn reload_gateway_nginx() -> Result<()> {
-        path: PathBuf::from(path),
+    ok(call(&PrivRequest::ReloadGatewayNginx).await?)
+}
+
+pub async fn chown_socket_dir(agent_name: &str, uid: u32, gid: u32) -> Result<()> {
+    ok(call(&PrivRequest::ChownSocketDir {
+        agent_name: agent_name.to_owned(),
         uid,
         gid,
-    })
+    }).await?)
-    .await?;
-    check(resp)?;
-    Ok(())
 }
 
-/// `chmod(path, mode)` via hive-priv.
+pub async fn chmod_socket_dir(agent_name: &str, mode: u32) -> Result<()> {
-///
+    ok(call(&PrivRequest::ChmodSocketDir {
-/// `path` must be under `/run/hive-agent/` or `/var/lib/hyperhive/`.
+        agent_name: agent_name.to_owned(),
-pub async fn chmod(path: &Path, mode: u32) -> Result<()> {
-    let resp = call(&PrivRequest::Chmod {
-        path: PathBuf::from(path),
         mode,
-    })
+    }).await?)
-    .await?;
-    check(resp)?;
-    Ok(())
-}
-
-/// Reload nginx inside `hive-gateway` via `systemd-run --machine`.
-pub async fn reload_gateway_nginx() -> Result<()> {
-    let resp = call(&PrivRequest::ReloadGatewayNginx).await?;
-    check(resp)?;
-    Ok(())
 }
 
 fn check(resp: PrivResponse) -> Result<(String, String)> {
     if resp.ok {
         Ok((resp.stdout, resp.stderr))
     } else {
-        bail!(
+        bail!("{}", resp.error.as_deref().unwrap_or("hive-priv returned error"))
-            "{}",
-            resp.error.as_deref().unwrap_or("hive-priv returned error")
-        )
     }
 }
+
+fn ok(resp: PrivResponse) -> Result<()> {
+    check(resp)?;
+    Ok(())
+}