85 lines
3.9 KiB
Nix
85 lines
3.9 KiB
Nix
{
|
|
description = "hyperhive deployed agents";
|
|
inputs = {
|
|
hyperhive.url = "@HYPERHIVE_URL@";
|
|
nixpkgs.follows = "hyperhive/nixpkgs";
|
|
};
|
|
outputs =
|
|
{ self, hyperhive, ... }@inputs:
|
|
let
|
|
mkAgent = { name, port, archetype ? null }:
|
|
let
|
|
base = hyperhive.nixosConfigurations.agent-base;
|
|
# Every flake an archetype can come from, by its source name.
|
|
archetypeSources = { inherit hyperhive; };
|
|
agentModule =
|
|
if archetype == null then
|
|
inputs."agent-${name}".nixosModules.default
|
|
else
|
|
(archetypeSources.${archetype.source}
|
|
or (throw "agent ${name}: archetype source ${archetype.source} is not an input of this hive's meta flake")
|
|
).hyperhiveArchetypes.${archetype.name}.module
|
|
or (throw "agent ${name}: this hive's ${archetype.source} input has no archetype ${archetype.name}; update that input");
|
|
service = "hive-agent";
|
|
in
|
|
base.extendModules {
|
|
modules = [
|
|
agentModule
|
|
{
|
|
# The harness service inside the container runs as a
|
|
# non-root unix user named after the agent (`damocles`,
|
|
# `iris`, `root`, …). UID auto-assigned by NixOS; the
|
|
# per-agent override here is what makes
|
|
# `services.hyperhive.agent.user.name` match the agent's identity
|
|
# instead of the harness default of `"agent"`.
|
|
services.hyperhive.agent.user.name = name;
|
|
# Without this an agent container is called `nixos` and ships
|
|
# every log line under that: nixpkgs sets the hostname from the
|
|
# attr name in the `containers.<name>` submodule, and an
|
|
# agent's system is its own `nixosSystem` off this flake, which
|
|
# never evaluates that option. The machine name, not the
|
|
# logical one — it is what `container.name` on our metrics and
|
|
# nspawn itself already call this container, so logs join to
|
|
# both without a prefix transform.
|
|
networking.hostName = "h-${name}";
|
|
programs.git.config.user = {
|
|
name = name;
|
|
email = "${name}@hyperhive.local";
|
|
};
|
|
# Container-wide env: every service + co-process daemon can
|
|
# resolve the agent's durable state dir without hard-coding it.
|
|
# `environment.variables` only writes /etc/environment (login
|
|
# shells); `systemd.globalEnvironment` is the analogue for
|
|
# systemd units so forge-avatar-sync /
|
|
# hive-matrix-daemon etc. can read `$HYPERHIVE_STATE_DIR`
|
|
# without each service having to redeclare it.
|
|
environment.variables = {
|
|
HIVE_LABEL = name;
|
|
HYPERHIVE_STATE_DIR = "/agents/${name}/state";
|
|
HYPERHIVE_HARNESS_DIR = "/agents/${name}/harness";
|
|
};
|
|
systemd.globalEnvironment = {
|
|
HIVE_LABEL = name;
|
|
HYPERHIVE_STATE_DIR = "/agents/${name}/state";
|
|
HYPERHIVE_HARNESS_DIR = "/agents/${name}/harness";
|
|
};
|
|
systemd.services.${service}.environment = {
|
|
HIVE_PORT = toString port;
|
|
HIVE_LABEL = name;
|
|
HYPERHIVE_STATE_DIR = "/agents/${name}/state";
|
|
HYPERHIVE_HARNESS_DIR = "/agents/${name}/harness";
|
|
};
|
|
}
|
|
# Tells the harness the agent has no config repo of its own.
|
|
(if archetype == null then { } else {
|
|
systemd.services.${service}.environment.HIVE_ARCHETYPE = archetype.name;
|
|
})
|
|
];
|
|
};
|
|
in
|
|
{
|
|
nixosConfigurations = {
|
|
rev1 = mkAgent { name = "rev1"; port = 8297; archetype = { source = "hyperhive"; name = "reviewer"; }; };
|
|
};
|
|
};
|
|
}
|