63 lines
2.2 KiB
Nix
63 lines
2.2 KiB
Nix
# REA ("Reverse Engineer Anything") for the agent: `services.hyperhive.agent.rea.enable`
|
|
# puts the `rea` CLI, Ghidra 12.1 (with its JDK) and procps in the container and
|
|
# registers `rea mcp` as `extraMcpServers.rea` with every tool auto-approved.
|
|
#
|
|
# - Ghidra is the pinned nixpkgs' `ghidra-bin` recipe at 12.1.x (see
|
|
# ../packages/ghidra-12-1.nix); REA rejects the pinned 12.0.4. Both packages
|
|
# come in through `services.hyperhive.agent.packages` only when this is on, so an
|
|
# agent without it keeps the shared closure.
|
|
# - REA's headless Ghidra needs a procps-compatible `ps` on PATH.
|
|
# - The Ghidra project lives under the agent's state dir. REA needs the `.rep`
|
|
# directory next to the `.gpr` path to exist, so tmpfiles creates both as the
|
|
# agent user.
|
|
# - The JVM heap (`GHIDRA_HEADLESS_MAXMEM`) shares the agent's memory cap
|
|
# (`agentMemoryMax`); nothing here raises it.
|
|
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.hyperhive.agent;
|
|
userName = cfg.user.name;
|
|
projectDir = "/agents/${userName}/state/rea";
|
|
ghidra = cfg.packages.ghidra-12-1;
|
|
env = {
|
|
GHIDRA_INSTALL_DIR = "${ghidra}/lib/ghidra";
|
|
JAVA_HOME = "${pkgs.openjdk21}";
|
|
REA_GHIDRA_PROJECT_PATH = "${projectDir}/analysis.gpr";
|
|
GHIDRA_HEADLESS_MAXMEM = "2G";
|
|
};
|
|
in
|
|
{
|
|
options.services.hyperhive.agent.rea.enable = lib.mkEnableOption ''
|
|
REA (Reverse Engineer Anything) with Ghidra in the container. Installs `rea`,
|
|
Ghidra 12.1 and procps, sets `GHIDRA_INSTALL_DIR`, `JAVA_HOME`,
|
|
`REA_GHIDRA_PROJECT_PATH` (under the agent's state dir) and
|
|
`GHIDRA_HEADLESS_MAXMEM`, and registers `rea mcp` as
|
|
`extraMcpServers.rea` with all its tools allowed. Ghidra's 2G heap counts
|
|
against the agent's normal memory cap
|
|
'';
|
|
|
|
config = lib.mkIf cfg.rea.enable {
|
|
services.hyperhive.agent.extraMcpServers.rea = {
|
|
command = "${cfg.packages.rea}/bin/rea";
|
|
args = [ "mcp" ];
|
|
inherit env;
|
|
allowedTools = [ "*" ];
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
cfg.packages.rea
|
|
ghidra
|
|
pkgs.procps
|
|
];
|
|
environment.variables = env;
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d ${projectDir} 0700 ${userName} ${userName} -"
|
|
"d ${projectDir}/analysis.rep 0700 ${userName} ${userName} -"
|
|
];
|
|
};
|
|
}
|