18ed3f5040
Thirty-three module-eval fixtures were a second (or later) full `nixosSystem` evaluation of a config another fixture already evaluated: 16 shapes defined identically in two to seven cluster files, plus duplicates inside agent-queue-bao, core-toggle and swarm-services-switch. Each cluster imports ./lib.nix itself, so nothing was shared between them. nix/module-eval/shared.nix now defines each of those 16 shapes once. nix/checks.nix instantiates it a single time and passes it as `shared` to the 23 clusters that read one, and each cluster rebinds the fixture under its existing local name. Assertions are unchanged. Case text changes only in core-toggle, where two cases built the forge-host fixture inline and now read the file's `forgeHere`, and in two inline `let` bindings (bao-otel-collector, grafana) that now take the shared fixture. Six folds are value-equal rather than textually equal: they drop an explicit `deploy.hive-controller.enable = false` or `deploy.swarm-otel.enable = false` that equals what the option already resolves to for that config. Nothing under nix/host-modules sets either option apart from the `mkDefault allSwarmServices` on swarm-otel, and the only option-priority read there is `domain.highestPrio`. Part of #5171.
186 lines
8 KiB
Nix
186 lines
8 KiB
Nix
# `checks.module-eval-agent-matrix` — see ./lib.nix for the shared
|
|
# rationale (why this suite exists, naming convention, "evaluates
|
|
# not executes").
|
|
{
|
|
pkgs,
|
|
lib,
|
|
self,
|
|
nixosSystem,
|
|
shared,
|
|
}:
|
|
let
|
|
inherit
|
|
(import ./lib.nix {
|
|
inherit
|
|
pkgs
|
|
lib
|
|
self
|
|
nixosSystem
|
|
;
|
|
})
|
|
agent
|
|
agentWith
|
|
runGroup
|
|
;
|
|
|
|
# Matrix's enable signal, which is the account set itself — there is no
|
|
# `matrix.enable` option left to read. Three arms, because the property has
|
|
# three distinct shapes and only one of them is the common case:
|
|
#
|
|
# - a homeserver URL, which is what the module turns into a `main` account;
|
|
# - neither URL nor operator account, the state that replaced
|
|
# `matrix.enable = false`. ⚠️ **This is the arm that matters.** `main` is
|
|
# declared by the module itself, so "any account declared" would be
|
|
# trivially true — and matrix would render for every agent in every hive —
|
|
# the moment that declaration stops being gated on the URL. Nothing else in
|
|
# this suite would notice;
|
|
# - an operator account carrying its own homeserver and no hive one, which is
|
|
# matrix on with no `main` at all.
|
|
agentMatrix = agent { matrix.url = "https://chat.t.local"; };
|
|
|
|
agentNoMatrix = shared.agentBare;
|
|
|
|
agentMatrixExternalOnly = agent {
|
|
matrixAccounts.ccc = {
|
|
tokenFile = "/agents/a1/state/matrix-token-ccc";
|
|
sessionDir = "/agents/a1/state/matrix-sdk-state-ccc";
|
|
homeserver = "https://matrix.example.invalid";
|
|
};
|
|
};
|
|
# The daemon that reads its tokens from the store, `main` included. Paired
|
|
# with `agentMatrix` above — same daemon, no store — so each case below can
|
|
# tell "carries the store's coordinates" from "every matrix daemon does".
|
|
agentMatrixBao = agentWith {
|
|
services.hyperhive.agent.bao.addr = "https://bao.t.local:8200";
|
|
services.hyperhive.agent.matrix.url = "https://chat.t.local";
|
|
};
|
|
|
|
daemon = machine: machine.systemd.services.hive-matrix-daemon;
|
|
cases = [
|
|
{
|
|
# A homeserver URL is the whole input: from it the module derives the
|
|
# hive-internal `main` account, and from a non-empty account set the three
|
|
# matrix pieces: daemon unit, path watcher and injected MCP entry.
|
|
name = "an agent with a homeserver gets a main account and the matrix units";
|
|
ok =
|
|
let
|
|
a = agentMatrix.services.hyperhive.agent.matrixAccounts;
|
|
in
|
|
lib.attrNames a == [ "main" ]
|
|
&& a.main.tokenFile == "/agents/a1/state/matrix-token"
|
|
&& a.main.homeserver == "https://chat.t.local"
|
|
&& agentMatrix.systemd.services ? hive-matrix-daemon
|
|
&& agentMatrix.systemd.paths ? hive-matrix-daemon
|
|
&& agentMatrix.services.hyperhive.agent.extraMcpServers ? matrix;
|
|
}
|
|
{
|
|
# The absence arm, and the reason the enable signal is not vacuous. An
|
|
# agent the hive gave no homeserver, whose operator declared nothing, must
|
|
# come out with an EMPTY account set — not a `main` that can never log in
|
|
# — and therefore with none of the three. Assert the emptiness itself and
|
|
# not just the units: it is the account set that is load-bearing now, and
|
|
# a `main` sneaking back in is the regression this case exists to name.
|
|
name = "an agent with no homeserver and no declared account gets no matrix at all";
|
|
ok =
|
|
agentNoMatrix.services.hyperhive.agent.matrixAccounts == { }
|
|
&& !(agentNoMatrix.systemd.services ? hive-matrix-daemon)
|
|
&& !(agentNoMatrix.systemd.paths ? hive-matrix-daemon)
|
|
&& !(agentNoMatrix.services.hyperhive.agent.extraMcpServers ? matrix);
|
|
}
|
|
{
|
|
# Matrix without a hive homeserver: one operator account, its own
|
|
# homeserver, no `main`. Under the deleted `matrix.enable` this config was
|
|
# an assertion failure ("extras require enable") even though every account
|
|
# in it was complete; the account set being the signal is what makes it
|
|
# expressible, and the serialized env var is where that has to show up.
|
|
name = "an external-only account enables matrix with no main entry";
|
|
ok =
|
|
let
|
|
accts = agentMatrixExternalOnly.services.hyperhive.agent.matrixAccounts;
|
|
env = agentMatrixExternalOnly.systemd.services.hive-matrix-daemon.environment;
|
|
in
|
|
lib.attrNames accts == [ "ccc" ]
|
|
&& !(accts ? main)
|
|
&&
|
|
builtins.fromJSON env.HIVE_MATRIX_ACCOUNTS == [
|
|
{
|
|
name = "ccc";
|
|
token_file = "/agents/a1/state/matrix-token-ccc";
|
|
state_dir = "/agents/a1/state/matrix-sdk-state-ccc";
|
|
homeserver = "https://matrix.example.invalid";
|
|
}
|
|
]
|
|
# No hive homeserver, so nothing may claim one.
|
|
&& !(env ? HIVE_MATRIX_URL);
|
|
}
|
|
{
|
|
# The daemon reads this agent's tokens from the store ITSELF, as itself,
|
|
# from inside this container — `main` too, since the swarm mints it and
|
|
# no hive does. So it needs the same identity ./agent-forge-bao.nix's
|
|
# fetch carries: the live pair, and the server CA from its credentials.
|
|
name = "the matrix daemon carries this agent's own store identity";
|
|
ok =
|
|
let
|
|
u = daemon agentMatrixBao;
|
|
in
|
|
u.serviceConfig.LoadCredential == [ "hive-agent-bao-server-ca" ]
|
|
&& u.environment.BAO_ADDR == "https://bao.t.local:8200"
|
|
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
|
|
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key"
|
|
&& builtins.elem "hive-agent-bao-identity.service" u.after;
|
|
}
|
|
{
|
|
# The agent's name, and nothing derived from it: the daemon builds its
|
|
# store path and its cert-auth role from this one string.
|
|
name = "the matrix daemon is told which agent it is and not where its credentials live";
|
|
ok =
|
|
let
|
|
e = (daemon agentMatrixBao).environment;
|
|
in
|
|
e.HIVE_AGENT_NAME == agentMatrixBao.services.hyperhive.agent.user.name
|
|
&& !(lib.any (lib.hasInfix "swarm/agents") (lib.attrValues e));
|
|
}
|
|
{
|
|
# 🩸 A secret is a path: every `BAO_*` entry is the store's address, a
|
|
# file under this unit's own credentials directory, or the one file of
|
|
# the live pair ./bao.nix keeps that its name stands for — never bytes
|
|
# in an environment `/proc/<pid>/environ` publishes. The live pair is
|
|
# spelled out rather than read from the option, so a default that
|
|
# turned into a value would fail here too.
|
|
name = "the matrix daemon is handed store paths and never store values";
|
|
ok =
|
|
let
|
|
store = lib.filterAttrs (n: _: lib.hasPrefix "BAO_" n) (daemon agentMatrixBao).environment;
|
|
livePair = {
|
|
BAO_CLIENT_CERT = "/run/hive-agent-bao-identity/current/cert";
|
|
BAO_CLIENT_KEY = "/run/hive-agent-bao-identity/current/key";
|
|
};
|
|
isPath =
|
|
n: n == "BAO_ADDR" || lib.hasPrefix "%d/" store.${n} || (livePair.${n} or null) == store.${n};
|
|
in
|
|
store != { } && lib.all isPath (lib.attrNames store);
|
|
}
|
|
{
|
|
# A token the swarm mints or replaces in the store changes no file, so
|
|
# the path watcher never sees it. The timer is what re-starts a daemon
|
|
# that exited on a missing or replaced token.
|
|
name = "a store-backed matrix daemon is re-started while it is down";
|
|
ok =
|
|
agentMatrixBao.systemd.timers.hive-matrix-daemon.timerConfig.OnUnitInactiveSec or null == "5min";
|
|
}
|
|
{
|
|
# The absence arm for the four above: with no store, no identity, no
|
|
# timer, and the file is the whole mechanism.
|
|
name = "a matrix daemon on an agent with no store declares no identity and no timer";
|
|
ok =
|
|
let
|
|
u = daemon agentMatrix;
|
|
in
|
|
!(u.serviceConfig ? LoadCredential)
|
|
&& !(u.environment ? BAO_ADDR)
|
|
&& !(u.environment ? HIVE_AGENT_NAME)
|
|
&& !(agentMatrix.systemd.timers ? hive-matrix-daemon);
|
|
}
|
|
];
|
|
in
|
|
runGroup "agent-matrix" cases
|