# The pre-start check of a container's root, for one of hyperhive's own
# declarative containers.
#
# nixpkgs' start script runs as host root against the container's own root,
# which is persistent and writable by the container, and its `mkdir`, `chmod`,
# `touch` and `cp` follow links the container planted there. `hive-priv
# check-rootfs` looks at the paths the script touches (rules in
# `hive-priv/src/prestart.rs`). With `--warn-only` it logs each violation at
# warning level and lets the start go on. The line carries systemd's `-`
# prefix, so a crash or a failed exec of the check cannot fail the start either.
# The agent containers run it strict
# from their per-agent drop-in (hive-priv's `WriteResourceLimits`).
#
# Pure function, not a NixOS module. A container's module calls it with its
# own name and folds the result into its unit:
#
#   rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
#   #   systemd.services."container@${machine}" = lib.mkMerge [ (rootfsCheck.warnOnly machine) … ];
#
# The name list is the callers', never `config.containers`: that also holds
# containers the operator runs that hyperhive doesn't own, and those get
# nothing. nixpkgs renders each declarative container as its own
# `container@<name>` unit (`nixos-containers.nix`, the `mapAttrsToList` that
# builds `container@${name}`), so a setting on that unit reaches that
# container only.
#
# The binary is run through `hivePriv`, a path that does not change with the hyperhive
# build. `hive-priv.nix` points the symlink at the current package, so the
# unit text is the same across builds and a switch does not restart the
# container for it.
{ ... }:
rec {
  hivePriv = "/run/hive-rootfs-check";

  # Attributes for `systemd.services."container@<name>"`.
  warnOnly = name: {
    serviceConfig.ExecStartPre = [
      "-${hivePriv} check-rootfs --warn-only ${name}"
    ];
  };
}