vinzenz/nixos-configuration
vinzenz/nixos-configuration
Watch
0
1
Fork
You've already forked nixos-configuration
 0
Code Activity

move swarm config to lpt2

Browse source
This commit is contained in:
müde 2026-10-10 13:07:40 +02:00
commit 8cb6b4e02e
6 changed files with 188 additions and 209 deletions
Download patch file Download diff file Expand all files Collapse all files

87
nixosConfigurations/muede-lpt2/claude.nix Normal file
View file

@ -0,0 +1,87 @@
{
config,
lib,
osConfig,
pkgs,
...
}:
let
claude-code = pkgs.unstable.claude-code;
# Endpoint and wire protocol come straight off the hive's own OTLP config in
# ./constellation-swarm.nix, so there is one place to change them.
# Only those two are shared: the hive's `agent=` / `hive=` / `swarm=` resource
# labels are deliberately not carried over.
hiveOtel = osConfig.services.hyperhive.otel;
# Written by the `claude-otel-user-header` oneshot in that same module, which
# copies the hive's root-only auth header into /run owned by this user.
# Absent until the oneshot has run (e.g. no credential yet), in which case the
# wrapper starts claude with no telemetry at all rather than retrying an
# unauthenticated export every interval.
headerFile = "${osConfig.my.constellation-swarm.userOtelHeaderDir}/${config.home.username}";
# OTEL's `host.arch` is an enum of its own spelling, not uname's.
hostArch =
{
x86_64-linux = "amd64";
aarch64-linux = "arm64";
}
.${pkgs.stdenv.hostPlatform.system} or pkgs.stdenv.hostPlatform.uname.processor;
# `deployment.environment.name` is what keeps these interactive sessions
# apart from the agent fleet in the same backend, now that the hive's own
# identifying labels are gone.
resourceAttributes = lib.concatStringsSep "," [
"service.name=claude-code"
"host.arch=${hostArch}"
"os.type=linux"
"deployment.environment.name=workstation"
];
# Env claude-code reads to export telemetry. Set by the wrapper rather than
# written into ~/.claude/settings.json, because that file is self-mutating —
# /model, /config and plugin toggles all write to it, so home-manager cannot
# own it without breaking them.
otelEnv = {
CLAUDE_CODE_ENABLE_TELEMETRY = "1";
OTEL_METRICS_EXPORTER = "otlp";
# Interactive sessions carry far more sensitive content than hive agents,
# so prompt events and tool-decision records never leave the machine.
OTEL_LOGS_EXPORTER = "none";
OTEL_TRACES_EXPORTER = "none";
OTEL_EXPORTER_OTLP_PROTOCOL = hiveOtel.protocol;
OTEL_EXPORTER_OTLP_ENDPOINT = hiveOtel.endpoint;
# claude-code defaults to DELTA, which Prometheus/Mimir-family backends
# silently drop without a deltatocumulative processor.
OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE = "cumulative";
OTEL_METRICS_INCLUDE_VERSION = "1";
}
# Follow the hive's export cadence too, so retuning it stays a one-line
# change over in constellation-swarm.nix. Null there leaves claude-code's
# own 60s default. `debug` is pointedly not mirrored: the OTEL SDK's stderr
# diagnostics would scribble over an interactive TUI.
// lib.optionalAttrs (hiveOtel.metricIntervalMs != null) {
OTEL_METRIC_EXPORT_INTERVAL = toString hiveOtel.metricIntervalMs;
};
exports = lib.concatStrings (
lib.mapAttrsToList (name: value: " export ${name}=${lib.escapeShellArg value}\n") otelEnv
);
# Shadows claude-code's own `bin/claude`, so claude-code itself is kept out
# of home.packages — two derivations installing the same
# binary is a home-manager collision, not a precedence win.
claude-wrapper = pkgs.writeShellScriptBin "claude" ''
hdr=${lib.escapeShellArg headerFile}
if [ -r "$hdr" ]; then
${exports} export OTEL_EXPORTER_OTLP_HEADERS="$(cat "$hdr")"
export OTEL_RESOURCE_ATTRIBUTES=${lib.escapeShellArg resourceAttributes}",host.name=$(${lib.getExe' pkgs.coreutils "uname"} -n)"
fi
exec ${claude-code}/bin/claude "$@"
'';
in
{
home.packages = [ claude-wrapper ];
}

129
nixosConfigurations/muede-lpt2/constellation-swarm.nix Normal file
View file

@ -0,0 +1,129 @@
{
hyperhive,
pkgs,
lib,
config,
...
}:
let
adminUsers = [ "muede" ];
otelCredential = "/etc/hyperhive/otel-cred";
runtimeDirName = "claude-otel";
old = "forge.pr1ma.darkest.space";
new = "forge.constellation.darkest.space";
in
{
options.my.constellation-swarm.userOtelHeaderDir = lib.mkOption {
type = lib.types.str;
default = "/run/${runtimeDirName}";
readOnly = true;
description = ''
Directory holding the per-admin copies of the hive's OTLP auth header,
one 0400 file per user named after them. Read-only so the home-manager
side (./claude.nix) can point at it via
`osConfig` instead of repeating the path.
'';
};
imports = [ hyperhive.nixosModules.default ];
config = {
services.hyperhive = {
swarm = {
name = "constellation";
domain = "constellation.darkest.space";
matrix = {
# not default - both still on hive domain
gatewayHost = "matrix.pr1ma.darkest.space";
serverName = "pr1ma.darkest.space";
};
hives = {
"umbra" = {
# not default - still not subdomain
domain = "umbra.darkest.space";
};
"pr1ma" = {
# not default - still not subdomain
domain = "pr1ma.darkest.space";
};
};
};
ruthless = true;
hiveName = "pr1ma";
gateway = {
localHostsEntry = true;
openFirewall = true;
# DNS: the hive's resolver must still answer for the old name, or
# nothing ever reaches the redirect. The forge module drops it from
# this list the moment you change `swarm.forge.domain`.
localNames = [ old ];
};
otel = {
enable = true;
endpoint = "https://exponentials.vibec0re.mov/otel";
headersCredential = otelCredential;
};
c0re = {
inherit adminUsers;
agentMemoryMax = "5G";
claudeCodePackage = pkgs.unstable.claude-code;
buildSlots = 2;
};
deploy = {
hive-controller.enable = true;
singleHostSwarm = true;
ci-runner = {
enable = true;
concurrency = 2;
};
};
};
services.nginx = {
enable = true;
virtualHosts.${old} =
let
gw = config.services.hyperhive.gateway;
in
(gw.lib.tlsFor old)
// {
listen = gw.lib.listen;
locations."/".return = "301 https://${new}$request_uri";
};
};
# Needs the hive's otel config and the header service below, so it lives
# here rather than in the shared home config.
home-manager.users.muede.imports = [ ./claude.nix ];
#containers.swarm-authelia.config.services.authelia.instances.swarm.settings.log.level =lib.mkForce "debug";
# `otelCredential` is root:root 0600, so the interactive `claude` an admin
# runs as themselves cannot read it — only the hive's agent units can, via
# LoadCredential. Hand each admin their own copy so the wrapper in
# ./claude.nix can pick it up. It lands in /run
# (tmpfs) rather than the nix store because the store is world-readable, and
# rather than /etc because the header should not outlive a reboot.
systemd.services.claude-otel-user-header = {
description = "Expose the hive OTLP auth header to interactive admin users";
wantedBy = [ "multi-user.target" ];
unitConfig.ConditionPathExists = otelCredential;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
RuntimeDirectory = runtimeDirName;
# Traversable by everyone; the per-user files inside are the 0400 part.
RuntimeDirectoryMode = "0755";
ExecStart = pkgs.writeShellScript "claude-otel-user-header" ''
set -eu
umask 077
for user in ${lib.escapeShellArgs adminUsers}; do
${lib.getExe' pkgs.coreutils "install"} -m0400 -o "$user" -g root \
${lib.escapeShellArg otelCredential} "$RUNTIME_DIRECTORY/$user"
done
'';
};
};
};
}

166
nixosConfigurations/muede-lpt2/default.nix
View file

@ -1,119 +1,75 @@
{
pkgs,
config,
lib,
...
}:
{
imports = [
./constellation-swarm.nix
./containers.nix
./hardware.nix
];
config = lib.mkMerge [
{
my = {
# keep-sorted start
intelGraphics.enable = true;
muedeDesktopSettings.enable = true;
podman.enable = true;
secureBoot.enable = true;
steam.enable = true;
users.muede.enable = true;
wineGaming.enable = true;
# keep-sorted end
};
my = {
# keep-sorted start
intelGraphics.enable = true;
muedeDesktopSettings.enable = true;
podman.enable = true;
secureBoot.enable = true;
steam.enable = true;
users.muede.enable = true;
wineGaming.enable = true;
# keep-sorted end
};
nix.settings.extra-platforms = [
"aarch64-linux"
"i686-linux"
];
# Global default (nixosModules/distributed-builds.nix) is MemoryMax=90%,
# which isn't tight enough on this machine's 31GiB to avoid OOM.
systemd.services.nix-daemon.serviceConfig = {
MemoryHigh = "60%";
MemoryMax = lib.mkForce "80%";
};
services.xserver.xkb = {
# Configure keymap in X11
layout = "de";
variant = "";
};
# Configure console keymap
console.keyMap = "de";
users.users.muede.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY pixel-JuiceSSH"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv pc2 home roaming"
];
# brightnessctl's udev rules grant the `video` group write access to backlight brightness (muede is in `video`)
environment.systemPackages = [
pkgs.android-tools
pkgs.brightnessctl
];
services.udev.packages = [ pkgs.brightnessctl ];
networking.firewall.allowedTCPPorts = [
8776
1337
];
services.servicepoint-tanks = {
enable = false;
urls = [
"http://localhost:5666"
"http://localhost:5667"
];
};
nixpkgs.config.permittedInsecurePackages = [
"mbedtls-2.28.10"
];
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
}
(
let
old = "forge.pr1ma.darkest.space";
new = "forge.constellation.darkest.space";
in
{
my.constellation-swarm = {
enable = true;
hiveName = "pr1ma";
};
services.hyperhive = {
deploy = {
singleHostSwarm = true;
forgejo.ci = {
enable = true;
concurrency = 2;
};
};
# DNS: the hive's resolver must still answer for the old name, or
# nothing ever reaches the redirect. The forge module drops it from
# this list the moment you change `swarm.forge.domain`.
gateway.localNames = [ old ];
};
services.nginx.enable = true;
services.nginx.virtualHosts.${old} =
let
gw = config.services.hyperhive.gateway;
in
(gw.lib.tlsFor old)
// {
listen = gw.lib.listen;
locations."/".return = "301 https://${new}$request_uri";
};
#containers.swarm-authelia.config.services.authelia.instances.swarm.settings.log.level =lib.mkForce "debug";
}
)
nix.settings.extra-platforms = [
"aarch64-linux"
"i686-linux"
];
# Global default (nixosModules/distributed-builds.nix) is MemoryMax=90%,
# which isn't tight enough on this machine's 31GiB to avoid OOM.
systemd.services.nix-daemon.serviceConfig = {
MemoryHigh = "60%";
MemoryMax = lib.mkForce "80%";
};
services.xserver.xkb = {
# Configure keymap in X11
layout = "de";
variant = "";
};
# Configure console keymap
console.keyMap = "de";
users.users.muede.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY pixel-JuiceSSH"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv pc2 home roaming"
];
# brightnessctl's udev rules grant the `video` group write access to backlight brightness (muede is in `video`)
environment.systemPackages = [
pkgs.android-tools
pkgs.brightnessctl
];
services.udev.packages = [ pkgs.brightnessctl ];
networking.firewall.allowedTCPPorts = [
8776
1337
];
services.servicepoint-tanks = {
enable = false;
urls = [
"http://localhost:5666"
"http://localhost:5667"
];
};
nixpkgs.config.permittedInsecurePackages = [
"mbedtls-2.28.10"
];
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
}

5
nixosConfigurations/muede-pc2/default.nix
View file

@ -47,10 +47,5 @@
# Factorio
34197
];
my.constellation-swarm = {
enable = false;
hiveName = "umbra";
};
};
}