hand agents the dashboard port, pinned claude and otel labels at container start
The three values that differ per host (deploy.hive-controller.dashboardPort, claudeCodePackage and otel.extraResourceAttributes) no longer go into the meta flake. hive-priv writes them into the container's /etc/hyperhive-hive-facts with the hive name and domain, and the agent reads them at boot: - HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator; the web UI still defaults to 7000 without it. - `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's claude when it is there, and the container's own claude-code otherwise. The host's serve.json keeps gc-rooting the pinned build. - OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES. The agent options services.hyperhive.agent.claudeCodePath (now a removed option) and otel.extraResourceAttributes go; only the meta render set them. render_flake takes no HiveEnv any more, so the memory-cap render test and render_hive_flake_at, which only existed to vary HiveEnv into the render, go with it. Refs #4857
This commit is contained in:
atlas
mara
parent
a32c144b80
commit
9113651c10
23 changed files with 408 additions and 335 deletions
|
|
@ -28,6 +28,28 @@ let
|
|||
which the hive writes before every start, so no agent build sets it.
|
||||
Remove the setting.
|
||||
'';
|
||||
claudeCodePathRemoved = ''
|
||||
An agent reads the claude-code its hive pins at runtime, from
|
||||
HYPERHIVE_CLAUDE_CODE_PATH in /etc/hyperhive-hive-facts, so no agent build
|
||||
sets it. Pin it host-side with
|
||||
services.hyperhive.deploy.hive-controller.claudeCodePackage.
|
||||
'';
|
||||
|
||||
# `claude` on PATH. A hive that pins a claude-code
|
||||
# (`services.hyperhive.deploy.hive-controller.claudeCodePackage`) hands its
|
||||
# store path over at container start as `HYPERHIVE_CLAUDE_CODE_PATH`, and
|
||||
# the host's system closure keeps it alive: nothing in this container
|
||||
# references it. With no pin, or a path that is not there, this container's
|
||||
# own claude-code runs. `exec -a claude` keeps the bare name in argv[0],
|
||||
# which is how the harness finds its claude child (`find_claude_child`).
|
||||
ownClaude = import ../claude-code-no-alsa.nix lib pkgs.claude-code;
|
||||
claude = pkgs.writeShellScriptBin "claude" ''
|
||||
pinned=''${HYPERHIVE_CLAUDE_CODE_PATH:-}
|
||||
if [ -n "$pinned" ] && [ -x "$pinned/bin/claude" ]; then
|
||||
exec -a claude "$pinned/bin/claude" "$@"
|
||||
fi
|
||||
exec -a claude ${ownClaude}/bin/claude "$@"
|
||||
'';
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
|
|
@ -68,6 +90,12 @@ in
|
|||
"agent"
|
||||
"claudeMemoryMaxBytes"
|
||||
] memoryMaxBytesRemoved)
|
||||
(lib.mkRemovedOptionModule [
|
||||
"services"
|
||||
"hyperhive"
|
||||
"agent"
|
||||
"claudeCodePath"
|
||||
] claudeCodePathRemoved)
|
||||
];
|
||||
|
||||
options.services.hyperhive.agent.icon = lib.mkOption {
|
||||
|
|
@ -87,33 +115,6 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
options.services.hyperhive.agent.claudeCodePath = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
example = "/nix/store/…-claude-code-2.1.220";
|
||||
description = ''
|
||||
Store path of the `claude-code` this agent runs, or `null` (the
|
||||
default) to use the `claude-code` from the container's own
|
||||
nixpkgs.
|
||||
|
||||
Set by the generated meta flake when the operator sets
|
||||
`services.hyperhive.deploy.hive-controller.claudeCodePackage` host-side, so a hive
|
||||
can run a claude built from a *different* nixpkgs than the one
|
||||
its agents evaluate against — a release channel can trail
|
||||
unstable by weeks on this one package. It arrives as a path and
|
||||
not a package because agents share the host's `/nix/store`, so
|
||||
the build is already reachable here with its whole closure and
|
||||
has nothing to travel.
|
||||
|
||||
When set, `claude` on PATH is a symlink to this path's
|
||||
`bin/claude` and the container's own `claude-code` is dropped, so
|
||||
there is only ever one claude in the container. Note that neither
|
||||
the symlink nor anything else in the container's closure *refers*
|
||||
to the target — keeping it alive is the host's job, see
|
||||
`services.hyperhive.deploy.hive-controller.claudeCodePackage`.
|
||||
'';
|
||||
};
|
||||
|
||||
config = {
|
||||
assertions = [
|
||||
# Guard the inputs-routed-as-output pattern: the agent flake.nix is
|
||||
|
|
@ -240,28 +241,7 @@ in
|
|||
config.services.hyperhive.agent.packages.hive-metric
|
||||
]
|
||||
++ [
|
||||
(
|
||||
if config.services.hyperhive.agent.claudeCodePath == null then
|
||||
import ../claude-code-no-alsa.nix lib pkgs.claude-code
|
||||
else
|
||||
# Host-pinned claude: a symlink farm around a path the
|
||||
# container was handed as text. It has to be a derivation —
|
||||
# `environment.systemPackages` coerces a store-path *string*
|
||||
# with `toDerivation`, i.e. `builtins.storePath`, which pure
|
||||
# evaluation rejects (`systemd.services.*.path` does the same,
|
||||
# which is why the harness gets this via PATH like everything
|
||||
# else rather than a unit-level entry). Interpolating the path
|
||||
# into the builder is just text, so it evaluates anywhere.
|
||||
#
|
||||
# The symlink registers no store reference — the target isn't
|
||||
# among this derivation's inputs, so nothing here keeps the
|
||||
# binary alive. That is deliberate and it is the host's job:
|
||||
# see `services.hyperhive.deploy.hive-controller.claudeCodePackage`.
|
||||
pkgs.runCommandLocal "claude-code-pinned" { } ''
|
||||
mkdir -p "$out/bin"
|
||||
ln -s ${config.services.hyperhive.agent.claudeCodePath}/bin/claude "$out/bin/claude"
|
||||
''
|
||||
)
|
||||
claude
|
||||
]
|
||||
++ (with pkgs; [
|
||||
bashInteractive
|
||||
|
|
|
|||
|
|
@ -2,8 +2,17 @@
|
|||
# agent's closure does not carry it.
|
||||
#
|
||||
# hive-priv writes `/etc/hyperhive-hive-facts` into the container before every
|
||||
# start (`HYPERHIVE_HIVE_NAME`, `HYPERHIVE_HIVE_DOMAIN`, one `KEY=value` line
|
||||
# each). Two readers hand those lines on:
|
||||
# start, one `KEY=value` line each:
|
||||
#
|
||||
# - `HYPERHIVE_HIVE_NAME`, `HYPERHIVE_HIVE_DOMAIN`;
|
||||
# - `HIVE_DASHBOARD_PORT`, read by the harness's web UI (7000 when absent);
|
||||
# - `HYPERHIVE_CLAUDE_CODE_PATH`, the claude-code the hive pins (`claude` in
|
||||
# ./default.nix runs this container's own when absent);
|
||||
# - `HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES`, appended to
|
||||
# `OTEL_RESOURCE_ATTRIBUTES` by ./otel.nix (no extra labels when absent).
|
||||
#
|
||||
# Any of them may be absent: a hive-c0re older than the agent's build writes
|
||||
# fewer. Two readers hand the lines on:
|
||||
#
|
||||
# - an environment generator, for the container's systemd: it passes them to
|
||||
# every unit it starts, `machinectl shell` sessions (`hivectl choom`)
|
||||
|
|
@ -23,8 +32,8 @@
|
|||
let
|
||||
userName = config.services.hyperhive.agent.user.name;
|
||||
|
||||
# Shell builtins only: nothing is assumed on PATH this early. Only the two
|
||||
# known keys are passed on. `|| [ -n "$key" ]` keeps a last line that has
|
||||
# Shell builtins only: nothing is assumed on PATH this early. Only the known
|
||||
# keys are passed on. `|| [ -n "$key" ]` keeps a last line that has
|
||||
# no trailing newline.
|
||||
generator = pkgs.writeShellScript "hyperhive-hive-facts" ''
|
||||
hive=unknown
|
||||
|
|
@ -32,7 +41,8 @@ let
|
|||
while IFS='=' read -r key value || [ -n "$key" ]; do
|
||||
case "$key" in
|
||||
HYPERHIVE_HIVE_NAME) hive=$value ;;
|
||||
HYPERHIVE_HIVE_DOMAIN) ;;
|
||||
HYPERHIVE_HIVE_DOMAIN | HIVE_DASHBOARD_PORT) ;;
|
||||
HYPERHIVE_CLAUDE_CODE_PATH | HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES) ;;
|
||||
*) continue ;;
|
||||
esac
|
||||
printf '%s=%s\n' "$key" "$value"
|
||||
|
|
|
|||
|
|
@ -42,9 +42,17 @@ let
|
|||
# agent, and their metric names already tell them apart. No `hive`: the
|
||||
# swarm collector stamps it from the receiver that accepted the hive's
|
||||
# push (nix/host-modules/swarm-otel.nix), so the build names no hive.
|
||||
resourceAttributes =
|
||||
"service.name=hyperhive-agent,agent=${userName},swarm=${swarmDisplayName}"
|
||||
+ lib.optionalString (cfg.extraResourceAttributes != "") ",${cfg.extraResourceAttributes}";
|
||||
resourceAttributes = "service.name=hyperhive-agent,agent=${userName},swarm=${swarmDisplayName}";
|
||||
|
||||
# Prints `OTEL_RESOURCE_ATTRIBUTES`: the labels above, then the hive's own
|
||||
# (`HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES`), which differ per host and so
|
||||
# arrive at container start. That variable comes from ./hive-facts.nix's
|
||||
# generator, which runs before this one and is absent when the hive sets no
|
||||
# labels.
|
||||
resourceGenerator = pkgs.writeShellScript "hyperhive-otel-resource" ''
|
||||
printf 'OTEL_RESOURCE_ATTRIBUTES=%s%s\n' ${lib.escapeShellArg resourceAttributes} \
|
||||
"''${HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES:+,$HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES}"
|
||||
'';
|
||||
|
||||
# The variables an OTEL SDK reads on its own, in any language, in any
|
||||
# process here.
|
||||
|
|
@ -62,7 +70,6 @@ let
|
|||
# which Prometheus/Mimir-family backends (incl. grafana-lgtm)
|
||||
# silently drop without a deltatocumulative processor.
|
||||
OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE = "cumulative";
|
||||
OTEL_RESOURCE_ATTRIBUTES = resourceAttributes;
|
||||
};
|
||||
|
||||
# The exporter's NAME picks the wire protocol, so `protocol` has to be
|
||||
|
|
@ -118,19 +125,6 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
extraResourceAttributes = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
internal = true;
|
||||
description = ''
|
||||
Extra comma-separated entries appended to
|
||||
`OTEL_RESOURCE_ATTRIBUTES` after the built-in
|
||||
`service.name` / `agent` / `swarm` labels.
|
||||
Host-driven via
|
||||
`services.hyperhive.deploy.hive-controller.otel.extraResourceAttributes`.
|
||||
'';
|
||||
};
|
||||
|
||||
debug = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
|
|
@ -167,6 +161,14 @@ in
|
|||
systemd.globalEnvironment = producerEnv;
|
||||
environment.variables = producerEnv;
|
||||
|
||||
# `OTEL_RESOURCE_ATTRIBUTES` is in neither: a unit's own `Environment=`
|
||||
# would override what the generator computes at boot. Units get it from
|
||||
# the manager's environment; login shells run the same generator after
|
||||
# ./hive-facts.nix's snippet has exported the hive's labels.
|
||||
environment.etc."systemd/system-environment-generators/60-hyperhive-otel-resource".source =
|
||||
resourceGenerator;
|
||||
environment.extraInit = lib.mkAfter ''export "$(${resourceGenerator})"'';
|
||||
|
||||
# The journal this container writes is reachable from inside it and
|
||||
# from nowhere else, which is why the forwarder runs here rather than
|
||||
# the hive reading the container's journal from outside: the host-side
|
||||
|
|
|
|||
Loading…
Reference in a new issue