move swarm config to lpt2

2026-10-10 13:07:40 +02:00 · 2026-10-10 13:07:40 +02:00 · 8cb6b4e02e
commit 8cb6b4e02e
parent d1a07fc978
6 changed files with 188 additions and 209 deletions
--- a/nixosConfigurations/muede-lpt2/constellation-swarm.nix
+++ b/nixosConfigurations/muede-lpt2/constellation-swarm.nix
@ -0,0 +1,129 @@
+{
+  hyperhive,
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  adminUsers = [ "muede" ];
+  otelCredential = "/etc/hyperhive/otel-cred";
+  runtimeDirName = "claude-otel";
+
+  old = "forge.pr1ma.darkest.space";
+  new = "forge.constellation.darkest.space";
+in
+{
+  options.my.constellation-swarm.userOtelHeaderDir = lib.mkOption {
+    type = lib.types.str;
+    default = "/run/${runtimeDirName}";
+    readOnly = true;
+    description = ''
+      Directory holding the per-admin copies of the hive's OTLP auth header,
+      one 0400 file per user named after them. Read-only so the home-manager
+      side (./claude.nix) can point at it via
+      `osConfig` instead of repeating the path.
+    '';
+  };
+
+  imports = [ hyperhive.nixosModules.default ];
+
+  config = {
+    services.hyperhive = {
+      swarm = {
+        name = "constellation";
+        domain = "constellation.darkest.space";
+        matrix = {
+          # not default - both still on hive domain
+          gatewayHost = "matrix.pr1ma.darkest.space";
+          serverName = "pr1ma.darkest.space";
+        };
+        hives = {
+          "umbra" = {
+            # not default - still not subdomain
+            domain = "umbra.darkest.space";
+          };
+          "pr1ma" = {
+            # not default - still not subdomain
+            domain = "pr1ma.darkest.space";
+          };
+        };
+      };
+      ruthless = true;
+      hiveName = "pr1ma";
+      gateway = {
+        localHostsEntry = true;
+        openFirewall = true;
+        # DNS: the hive's resolver must still answer for the old name, or
+        # nothing ever reaches the redirect. The forge module drops it from
+        # this list the moment you change `swarm.forge.domain`.
+        localNames = [ old ];
+      };
+      otel = {
+        enable = true;
+        endpoint = "https://exponentials.vibec0re.mov/otel";
+        headersCredential = otelCredential;
+      };
+      c0re = {
+        inherit adminUsers;
+        agentMemoryMax = "5G";
+        claudeCodePackage = pkgs.unstable.claude-code;
+        buildSlots = 2;
+      };
+      deploy = {
+        hive-controller.enable = true;
+        singleHostSwarm = true;
+        ci-runner = {
+          enable = true;
+          concurrency = 2;
+        };
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts.${old} =
+        let
+          gw = config.services.hyperhive.gateway;
+        in
+        (gw.lib.tlsFor old)
+        // {
+          listen = gw.lib.listen;
+          locations."/".return = "301 https://${new}$request_uri";
+        };
+    };
+
+    # Needs the hive's otel config and the header service below, so it lives
+    # here rather than in the shared home config.
+    home-manager.users.muede.imports = [ ./claude.nix ];
+
+    #containers.swarm-authelia.config.services.authelia.instances.swarm.settings.log.level =lib.mkForce "debug";
+
+    # `otelCredential` is root:root 0600, so the interactive `claude` an admin
+    # runs as themselves cannot read it — only the hive's agent units can, via
+    # LoadCredential. Hand each admin their own copy so the wrapper in
+    # ./claude.nix can pick it up. It lands in /run
+    # (tmpfs) rather than the nix store because the store is world-readable, and
+    # rather than /etc because the header should not outlive a reboot.
+    systemd.services.claude-otel-user-header = {
+      description = "Expose the hive OTLP auth header to interactive admin users";
+      wantedBy = [ "multi-user.target" ];
+      unitConfig.ConditionPathExists = otelCredential;
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        RuntimeDirectory = runtimeDirName;
+        # Traversable by everyone; the per-user files inside are the 0400 part.
+        RuntimeDirectoryMode = "0755";
+        ExecStart = pkgs.writeShellScript "claude-otel-user-header" ''
+          set -eu
+          umask 077
+          for user in ${lib.escapeShellArgs adminUsers}; do
+            ${lib.getExe' pkgs.coreutils "install"} -m0400 -o "$user" -g root \
+              ${lib.escapeShellArg otelCredential} "$RUNTIME_DIRECTORY/$user"
+          done
+        '';
+      };
+    };
+  };
+}