c8df666bf3
Part of #5081. Follow-up to the review of #5131. - Before this PR, claude read CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX from managed-settings.json in every context. The environment generator reaches every unit of the container's manager, including `machinectl shell` (hivectl choom): machined starts it as a transient container-shell@ unit (systemd 260.5 src/machine/machine.c:980-1004), and every unit's exec environment starts from the manager environment the generators fill (src/core/unit.c:5557, src/core/manager.c:3990-4001). Shells no unit starts do not get it: `nixos-container root-login` / `run` enter with nsenter + `su -l`, and getty logins go through login(1). So hive-facts.nix now also exports the generator's output from /etc/set-environment (environment.extraInit). - The generator's read loop kept a last line only when it ended in a newline; it now keeps one without. - checks.script-test-agent-hive-facts runs the rendered generator and the shell snippet (under dash and bash's sh) against sample files: both facts, a planted LD_PRELOAD/PATH line, a last line without a newline, an empty file and no file. - identity.rs: hive_name()'s doc names the facts file as the source.
62 lines
2.3 KiB
Nix
62 lines
2.3 KiB
Nix
# The hive this container runs on, read at boot rather than built in, so an
|
|
# agent's closure does not carry it.
|
|
#
|
|
# hive-priv writes `/etc/hyperhive-hive-facts` into the container before every
|
|
# start (`HYPERHIVE_HIVE_NAME`, `HYPERHIVE_HIVE_DOMAIN`, one `KEY=value` line
|
|
# each). Two readers hand those lines on:
|
|
#
|
|
# - an environment generator, for the container's systemd: it passes them to
|
|
# every unit it starts, `machinectl shell` sessions (`hivectl choom`)
|
|
# included, since those are transient units of the same manager. A unit's
|
|
# own `Environment=` still overrides them.
|
|
# - `/etc/set-environment`, for login shells that no unit starts:
|
|
# `nixos-container root-login` / `run` (nsenter + `su -l`, which resets the
|
|
# environment) and getty logins.
|
|
#
|
|
# Tested by `checks.script-test-agent-hive-facts`.
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
userName = config.services.hyperhive.agent.user.name;
|
|
|
|
# Shell builtins only: nothing is assumed on PATH this early. Only the two
|
|
# known keys are passed on. `|| [ -n "$key" ]` keeps a last line that has
|
|
# no trailing newline.
|
|
generator = pkgs.writeShellScript "hyperhive-hive-facts" ''
|
|
hive=unknown
|
|
if [ -r /etc/hyperhive-hive-facts ]; then
|
|
while IFS='=' read -r key value || [ -n "$key" ]; do
|
|
case "$key" in
|
|
HYPERHIVE_HIVE_NAME) hive=$value ;;
|
|
HYPERHIVE_HIVE_DOMAIN) ;;
|
|
*) continue ;;
|
|
esac
|
|
printf '%s=%s\n' "$key" "$value"
|
|
done < /etc/hyperhive-hive-facts
|
|
fi
|
|
# Names claude's remote-control sessions `<hive>-<agent>`.
|
|
printf 'CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=%s-%s\n' "$hive" ${lib.escapeShellArg userName}
|
|
'';
|
|
|
|
# Sourced by every shell's `/etc/set-environment`, so POSIX sh only. Each
|
|
# line is exported as one word and never evaluated.
|
|
profile = pkgs.writeText "hyperhive-hive-facts.sh" ''
|
|
while IFS= read -r __hyperhive_fact; do
|
|
case "$__hyperhive_fact" in
|
|
?*=*) export "$__hyperhive_fact" ;;
|
|
esac
|
|
done <<__HYPERHIVE_FACTS__
|
|
$(${generator})
|
|
__HYPERHIVE_FACTS__
|
|
unset __hyperhive_fact
|
|
'';
|
|
in
|
|
{
|
|
environment.etc."systemd/system-environment-generators/50-hyperhive-hive-facts".source = generator;
|
|
environment.etc."hyperhive/hive-facts.sh".source = profile;
|
|
environment.extraInit = ". /etc/hyperhive/hive-facts.sh";
|
|
}
|