71 lines
3 KiB
Nix
71 lines
3 KiB
Nix
{ pkgs, config, ... }:
|
|
let
|
|
userName = config.hyperhive.user.name;
|
|
in
|
|
{
|
|
imports = [ ./harness-base.nix ];
|
|
|
|
# Manager auto-unsubscribes from repo watches and skips the subscription/
|
|
# participation firehose — only direct mentions, reviews, and assignments
|
|
# land in the inbox. Sub-agents default to keepSubscriptions=true and
|
|
# skipNotifyReasons=[].
|
|
hyperhive.forge.keepSubscriptions = false;
|
|
hyperhive.forge.skipNotifyReasons = [
|
|
"subscribed"
|
|
"participating"
|
|
];
|
|
|
|
# HIVE_PORT/HIVE_LABEL/gitconfig are also injected by the generated
|
|
# `applied/hm1nd/flake.nix` (see `lifecycle::setup_applied`); the values
|
|
# here are the base config so the container stays sensible if anyone
|
|
# ever evaluates `nixosConfigurations.manager` standalone.
|
|
systemd.services.hive-m1nd = {
|
|
description = "hive-m1nd manager harness";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
environment = {
|
|
HIVE_PORT = "8000";
|
|
HIVE_LABEL = "hm1nd";
|
|
SHELL = "${pkgs.bashInteractive}/bin/bash";
|
|
# `HOME` set explicitly so claude finds `~/.claude/` at the
|
|
# bind-mounted location after #658 (User= drop from root).
|
|
HOME = "/home/${userName}";
|
|
# Manager runs the same hive-m1nd harness binary that serves
|
|
# the per-agent web UI; point it at the merged agent static dist
|
|
# (same shape as for sub-agents).
|
|
HIVE_STATIC_DIR = "${config.hyperhive.frontend.mergedDist}";
|
|
# Static runtime assets (branding + claude prompts). Set on the
|
|
# unit directly — `environment.variables` in harness-base.nix only
|
|
# populates /etc/profile, which systemd services don't inherit.
|
|
HIVE_ASSETS_DIR = "${pkgs.hyperhive-assets}/share/hyperhive";
|
|
};
|
|
# See note in agent-base.nix for the rationale on both entries —
|
|
# `/run/wrappers/bin` so the setuid sudo shim resolves before the
|
|
# bare nix-store binary (#658 fixup), `/run/current-system/sw`
|
|
# so the harness PATH tracks `environment.systemPackages`.
|
|
path = [
|
|
"/run/wrappers/bin"
|
|
"/run/current-system/sw"
|
|
];
|
|
serviceConfig = {
|
|
ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
|
|
Restart = "on-failure";
|
|
RestartSec = 2;
|
|
# `/run/hive-config/` is a per-service runtime dir owned by
|
|
# the agent user (`User=` below), auto-cleared by systemd on
|
|
# stop. The harness writes its regenerated
|
|
# claude-{mcp-config,settings,system-prompt} files there
|
|
# (see `paths::config_dir`). Kept separate from `/run/hive`
|
|
# — that bind comes in root-owned from the host and holds
|
|
# hive-c0re's `mcp.sock` we only connect to (#658 fixup).
|
|
RuntimeDirectory = "hive-config";
|
|
# Same drop-from-root as agent-base.nix (#658). Manager
|
|
# interactions with the host (rebuild approvals, config
|
|
# writes) still happen via the dedicated unix sockets
|
|
# bind-mounted from hive-c0re — those don't need root
|
|
# inside the container.
|
|
User = userName;
|
|
Group = userName;
|
|
};
|
|
};
|
|
}
|