vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Compare commits

base: vinzenz:2e9c50ecc7faf9eaf7a0f293a359fcfff42bc8fa
Branches Tags
vinzenz:main
..
compare: vinzenz:c73c8389eccc136fa3c2d3e7a19f0568f105c772
Branches Tags
vinzenz:main
1 changed files with 0 additions and 125 deletions
Download patch file Download diff file Expand all files Collapse all files

125
nix/templates/harness-base.nix
View file

@ -75,31 +75,6 @@ in
'';
};
options.hyperhive.role = lib.mkOption {
type = lib.types.enum [
"agent"
"manager"
];
default = "agent";
example = "manager";
description = ''
Whether this container runs as a sub-agent (`"agent"`, the
default — invokes `hive-ag3nt serve`) or as the swarm's
manager (`"manager"` — invokes `hive-m1nd serve` and
defaults the forge notification surface to mentions-only).
meta.rs flips this to `"manager"` for the manager container
and leaves it at the default for every sub-agent. Agents
and `agent.nix` files don't normally touch this option;
it's exposed so a standalone `nixos-rebuild` against
`nixosConfigurations.manager` keeps working without the
meta-flake wrapper around it.
Closes #671: harness + manager templates merged into a
single `harness-base.nix` driven by this option.
'';
};
options.hyperhive.model = lib.mkOption {
type = lib.types.str;
default = "haiku";
@ -1216,106 +1191,6 @@ in
};
};
# Manager-only forge defaults (#671): skip the
# subscription/participation firehose so the manager's inbox
# only carries direct mentions, reviews, and assignments. Sub-
# agents keep the noisier defaults (`keepSubscriptions = true`,
# `skipNotifyReasons = [ ]`). `mkDefault` so any agent that
# wants to invert it can.
hyperhive.forge = lib.mkIf (config.hyperhive.role == "manager") {
keepSubscriptions = lib.mkDefault false;
skipNotifyReasons = lib.mkDefault [
"subscribed"
"participating"
];
};
# Harness systemd unit. Role-driven so the same `harness-base.nix`
# covers both `nixosConfigurations.agent-base` (`hive-ag3nt serve`)
# and `nixosConfigurations.manager` (`hive-m1nd serve`) without a
# second template file (#671). Per-agent HIVE_PORT / HIVE_LABEL
# come from the meta-flake's generated `applied/<name>/flake.nix`;
# the manager has hardcoded fallbacks here so `nixosConfigurations.manager`
# still builds standalone.
systemd.services.${if config.hyperhive.role == "manager" then "hive-m1nd" else "hive-ag3nt"} =
let
isManager = config.hyperhive.role == "manager";
binary = if isManager then "hive-m1nd" else "hive-ag3nt";
in
{
description = "${binary}${lib.optionalString isManager " manager"} harness";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
# systemd units get a minimal PATH by default and don't inherit
# `environment.systemPackages`. Pointing at `/run/current-system/sw`
# gives the harness (and any tools claude shells out to via Bash)
# access to everything declared in `systemPackages` — including
# anything an agent adds to its own `agent.nix` — without having
# to touch the service definition.
#
# `/run/wrappers/bin` prepended so the `security.wrappers`
# setuid shims (notably `sudo`) resolve before the bare
# nix-store binaries in `/run/current-system/sw/bin`.
# Post-#658 the harness runs as the per-agent user — without
# the wrapper dir on PATH, `sudo` resolves to the un-setuid
# nix-store binary and refuses with "must be owned by uid 0
# and have the setuid bit set" even when
# `hyperhive.user.passwordlessSudo = true` is configured
# (#672 fixup pulled forward into this PR to avoid the
# regression argus flagged on #676).
path = [
"/run/wrappers/bin"
"/run/current-system/sw"
];
environment = {
SHELL = "${pkgs.bashInteractive}/bin/bash";
# `HOME` defaults to `/` for systemd services without a User=
# set. With #658 the harness runs as the agent user — set HOME
# explicitly so claude (which the harness spawns) finds its
# `~/.claude/` session dir at the bind-mounted location.
HOME = homeDir;
# Path to the merged agent static dist. The harness serves this
# via `tower_http::ServeDir` for any request it doesn't route to
# an API endpoint. `mergedDist` is the agent-default dist with
# `hyperhive.frontend.extraFiles` layered on top.
HIVE_STATIC_DIR = "${config.hyperhive.frontend.mergedDist}";
# Static runtime assets (branding + claude prompts). Set on the
# unit directly — `environment.variables` only populates
# /etc/profile, which systemd services don't inherit.
HIVE_ASSETS_DIR = "${pkgs.hyperhive-assets}/share/hyperhive";
}
// lib.optionalAttrs isManager {
# Standalone-eval fallbacks for `nixosConfigurations.manager`.
# meta.rs overrides both via the per-agent generated
# `applied/hm1nd/flake.nix` (see `lifecycle::setup_applied`);
# the values here keep the container sensible if anyone
# evaluates the standalone config.
HIVE_PORT = "8000";
HIVE_LABEL = "hm1nd";
};
serviceConfig = {
ExecStart = "${pkgs.hyperhive}/bin/${binary} serve";
Restart = "on-failure";
RestartSec = 2;
# `/run/hive-config/` is a per-service runtime dir owned by
# the agent user (`User=` below), auto-cleared by systemd on
# stop. The harness writes its regenerated
# claude-{mcp-config,settings,system-prompt} files there
# (see `paths::config_dir`). Kept separate from `/run/hive`
# — that bind comes in root-owned from the host and holds
# hive-c0re's `mcp.sock` we only connect to (#658 fixup).
RuntimeDirectory = "hive-config";
# Run the harness as the per-agent user (#658). claude itself
# spawned by the harness then runs as that user too — drops
# root inside the container while sudo (`NOPASSWD: ALL` by
# default, see `hyperhive.user.passwordlessSudo`) keeps the
# previous root-by-default surface available explicitly for
# tools that need it.
User = userName;
Group = userName;
};
};
system.stateVersion = "25.11";
};
}