97 lines
4 KiB
Nix
97 lines
4 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
{
|
|
# Optional Weston (the reference Wayland compositor) with the RDP
|
|
# backend, surfaced as a per-agent hyperhive option. An agent turns
|
|
# it on from its own `agent.nix`:
|
|
#
|
|
# hyperhive.westonRdp.enable = true;
|
|
#
|
|
# Imported by `harness-base.nix`, so every sub-agent + the manager
|
|
# has the option available; only those that flip it on get the
|
|
# service. This is a flat per-agent option (evaluated inside that
|
|
# agent's own container build) — NOT a `hyperhive.agents.<name>.*`
|
|
# registry, which can't work: each agent is its own
|
|
# nixosConfiguration and has no cross-agent view.
|
|
|
|
options.hyperhive.westonRdp.enable = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Run Weston with the RDP backend as a systemd service, for
|
|
remote-desktop access to the agent's container. A self-signed
|
|
TLS cert/key pair is generated on first start under
|
|
`/var/lib/weston`. Renders in software (pixman) — no GPU, DRM,
|
|
or VT access, so no extra container capabilities are needed.
|
|
|
|
The unit is deliberately built so enabling it can NEVER abort
|
|
the agent's `nixos-container update`: `Type = "simple"` (so
|
|
`switch-to-configuration` doesn't block on weston readiness)
|
|
and an `ExecStartPre` that always exits 0. A misconfigured
|
|
weston degrades to a restart loop visible in `journalctl` — it
|
|
does not block the rebuild. (Same reasoning as the `tea-login`
|
|
unit in `harness-base.nix`.)
|
|
|
|
Host networking means the RDP port (3389) is reachable on the
|
|
host. With more than one RDP-enabled agent the port would
|
|
collide — add a port knob to this option before that happens.
|
|
'';
|
|
};
|
|
|
|
config = lib.mkIf config.hyperhive.westonRdp.enable {
|
|
systemd.services.weston = {
|
|
description = "Weston Wayland compositor (RDP backend)";
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
# `simple`, not `notify`: switch-to-configuration must not
|
|
# wait on weston signalling readiness. A `notify` unit that
|
|
# never sends READY=1 fails after TimeoutStartSec, which
|
|
# aborts `nixos-container update` on every reload — exactly
|
|
# the trap `tea-login` documents.
|
|
Type = "simple";
|
|
# Creates /var/lib/weston (0700 root) before ExecStartPre.
|
|
StateDirectory = "weston";
|
|
Environment = "XDG_RUNTIME_DIR=/run/user/0";
|
|
# Runtime dir + first-boot cert generation. No `set -e`, and
|
|
# it always exits 0: a cert hiccup must not fail the unit
|
|
# start (that would abort the rebuild). If the cert/key end
|
|
# up missing, weston's own ExecStart fails into the Restart
|
|
# loop instead — graceful degradation, not a blocked deploy.
|
|
ExecStartPre = pkgs.writeShellScript "weston-rdp-setup" ''
|
|
mkdir -p /run/user/0 && chmod 700 /run/user/0 || true
|
|
CERT=/var/lib/weston/weston-rdp.crt
|
|
KEY=/var/lib/weston/weston-rdp.key
|
|
if [ ! -f "$CERT" ] || [ ! -f "$KEY" ]; then
|
|
if ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:2048 \
|
|
-keyout "$KEY" -out "$CERT" -days 3650 -nodes \
|
|
-subj "/CN=localhost" 2>/dev/null; then
|
|
chmod 600 "$KEY" 2>/dev/null || true
|
|
chmod 644 "$CERT" 2>/dev/null || true
|
|
else
|
|
echo "weston-rdp-setup: cert generation failed; weston will retry"
|
|
fi
|
|
fi
|
|
exit 0
|
|
'';
|
|
ExecStart = lib.concatStringsSep " " [
|
|
"${pkgs.weston}/bin/weston"
|
|
"--backend=rdp-backend.so"
|
|
"--renderer=pixman"
|
|
"--rdp-tls-cert=/var/lib/weston/weston-rdp.crt"
|
|
"--rdp-tls-key=/var/lib/weston/weston-rdp.key"
|
|
];
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
};
|
|
};
|
|
|
|
# weston on the agent's interactive PATH too, so claude can run
|
|
# Wayland clients / `weston-info` against the compositor.
|
|
environment.systemPackages = [ pkgs.weston ];
|
|
};
|
|
}
|