9113651c10
The three values that differ per host (deploy.hive-controller.dashboardPort, claudeCodePackage and otel.extraResourceAttributes) no longer go into the meta flake. hive-priv writes them into the container's /etc/hyperhive-hive-facts with the hive name and domain, and the agent reads them at boot: - HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator; the web UI still defaults to 7000 without it. - `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's claude when it is there, and the container's own claude-code otherwise. The host's serve.json keeps gc-rooting the pinned build. - OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES. The agent options services.hyperhive.agent.claudeCodePath (now a removed option) and otel.extraResourceAttributes go; only the meta render set them. render_flake takes no HiveEnv any more, so the memory-cap render test and render_hive_flake_at, which only existed to vary HiveEnv into the render, go with it. Refs #4857
72 lines
2.8 KiB
Nix
72 lines
2.8 KiB
Nix
# The hive this container runs on, read at boot rather than built in, so an
|
|
# agent's closure does not carry it.
|
|
#
|
|
# hive-priv writes `/etc/hyperhive-hive-facts` into the container before every
|
|
# start, one `KEY=value` line each:
|
|
#
|
|
# - `HYPERHIVE_HIVE_NAME`, `HYPERHIVE_HIVE_DOMAIN`;
|
|
# - `HIVE_DASHBOARD_PORT`, read by the harness's web UI (7000 when absent);
|
|
# - `HYPERHIVE_CLAUDE_CODE_PATH`, the claude-code the hive pins (`claude` in
|
|
# ./default.nix runs this container's own when absent);
|
|
# - `HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES`, appended to
|
|
# `OTEL_RESOURCE_ATTRIBUTES` by ./otel.nix (no extra labels when absent).
|
|
#
|
|
# Any of them may be absent: a hive-c0re older than the agent's build writes
|
|
# fewer. Two readers hand the lines on:
|
|
#
|
|
# - an environment generator, for the container's systemd: it passes them to
|
|
# every unit it starts, `machinectl shell` sessions (`hivectl choom`)
|
|
# included, since those are transient units of the same manager. A unit's
|
|
# own `Environment=` still overrides them.
|
|
# - `/etc/set-environment`, for login shells that no unit starts:
|
|
# `nixos-container root-login` / `run` (nsenter + `su -l`, which resets the
|
|
# environment) and getty logins.
|
|
#
|
|
# Tested by `checks.script-test-agent-hive-facts`.
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
userName = config.services.hyperhive.agent.user.name;
|
|
|
|
# Shell builtins only: nothing is assumed on PATH this early. Only the known
|
|
# keys are passed on. `|| [ -n "$key" ]` keeps a last line that has
|
|
# no trailing newline.
|
|
generator = pkgs.writeShellScript "hyperhive-hive-facts" ''
|
|
hive=unknown
|
|
if [ -r /etc/hyperhive-hive-facts ]; then
|
|
while IFS='=' read -r key value || [ -n "$key" ]; do
|
|
case "$key" in
|
|
HYPERHIVE_HIVE_NAME) hive=$value ;;
|
|
HYPERHIVE_HIVE_DOMAIN | HIVE_DASHBOARD_PORT) ;;
|
|
HYPERHIVE_CLAUDE_CODE_PATH | HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES) ;;
|
|
*) continue ;;
|
|
esac
|
|
printf '%s=%s\n' "$key" "$value"
|
|
done < /etc/hyperhive-hive-facts
|
|
fi
|
|
# Names claude's remote-control sessions `<hive>-<agent>`.
|
|
printf 'CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=%s-%s\n' "$hive" ${lib.escapeShellArg userName}
|
|
'';
|
|
|
|
# Sourced by every shell's `/etc/set-environment`, so POSIX sh only. Each
|
|
# line is exported as one word and never evaluated.
|
|
profile = pkgs.writeText "hyperhive-hive-facts.sh" ''
|
|
while IFS= read -r __hyperhive_fact; do
|
|
case "$__hyperhive_fact" in
|
|
?*=*) export "$__hyperhive_fact" ;;
|
|
esac
|
|
done <<__HYPERHIVE_FACTS__
|
|
$(${generator})
|
|
__HYPERHIVE_FACTS__
|
|
unset __hyperhive_fact
|
|
'';
|
|
in
|
|
{
|
|
environment.etc."systemd/system-environment-generators/50-hyperhive-hive-facts".source = generator;
|
|
environment.etc."hyperhive/hive-facts.sh".source = profile;
|
|
environment.extraInit = ". /etc/hyperhive/hive-facts.sh";
|
|
}
|