# The pre-start check of a container's root, for every `container@` instance.
#
# nixpkgs' start script runs as host root against the container's own root,
# which is persistent and writable by the container, and its `mkdir`, `chmod`,
# `touch` and `cp` follow links the container planted there. A drop-in on the
# `container@` template runs `hive-priv check-rootfs %i` as an `ExecStartPre=`
# before the script (`hive-priv/src/prestart.rs` has the rules). It covers the
# agents' imperative instances and the declarative ones (hive-forge,
# hive-matrix, the swarm services), each of which has a unit file of its own:
# systemd reads the template's drop-in directory for every instance.
#
# Order: systemd parses a drop-in after the unit file, so this line follows the
# unit file's own `ExecStartPre=` (nixpkgs' `preStart`, which touches no path
# under the root), and `ExecStart=` runs only after every `ExecStartPre=`
# succeeded.
#
# The drop-in is a unit-file package rather than `systemd.services."container@"`
# because that attribute renders the template's own unit file, which a
# declarative instance's unit file replaces.
{
  config,
  lib,
  pkgs,
  ...
}:
let
  dropin = pkgs.writeTextFile {
    name = "hyperhive-container-rootfs-check";
    destination = "/lib/systemd/system/container@.service.d/10-hyperhive-rootfs-check.conf";
    text = ''
      [Service]
      ExecStartPre=${config.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs %i
    '';
  };
in
{
  config = lib.mkIf config.boot.enableContainers {
    systemd.packages = [ dropin ];

    # The per-agent drop-ins this check replaced rooted a hive-priv build per
    # agent here. Boot is the one time no such drop-in is loaded.
    systemd.tmpfiles.rules = [ "R! /nix/var/nix/gcroots/hyperhive-check-rootfs - - - - -" ];
  };
}