move swarm config to lpt2

nixosModules/constellation-swarm.nix

@@ -1,100 +0,0 @@
-{
-  hyperhive,
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-let
-  cfg = config.my.constellation-swarm;
-  adminUsers = [ "muede" ];
-  otelCredential = "/etc/hyperhive/otel-cred";
-  runtimeDirName = "claude-otel";
-in
-{
-  options.my.constellation-swarm = {
-    enable = lib.mkEnableOption "hyperhive / constellation swarm";
-    hiveName = lib.mkOption { type = lib.types.str; };
-
-    userOtelHeaderDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/run/${runtimeDirName}";
-      readOnly = true;
-      description = ''
-        Directory holding the per-admin copies of the hive's OTLP auth header,
-        one 0400 file per user named after them. Read-only so the home-manager
-        side (homeConfigurations/muede/claude.nix) can point at it via
-        `osConfig` instead of repeating the path.
-      '';
-    };
-  };
-
-  imports = [ hyperhive.nixosModules.default ];
-
-  config.services.hyperhive = lib.mkIf cfg.enable {
-    enable = true;
-    swarm = {
-      name = "constellation";
-      domain = "constellation.darkest.space";
-      matrix = {
-        # not default - both still on hive domain
-        gatewayHost = "matrix.pr1ma.darkest.space";
-        serverName = "pr1ma.darkest.space";
-      };
-      hives = {
-        "umbra" = {
-          # not default - still not subdomain
-          domain = "umbra.darkest.space";
-        };
-        "pr1ma" = {
-          # not default - still not subdomain
-          domain = "pr1ma.darkest.space";
-        };
-      };
-    };
-    ruthless = true;
-    hiveName = cfg.hiveName;
-    gateway = {
-      localHostsEntry = true;
-      openFirewall = true;
-    };
-    otel = {
-      enable = true;
-      endpoint = "https://exponentials.vibec0re.mov/otel";
-      headersCredential = otelCredential;
-    };
-    c0re = {
-      inherit adminUsers;
-      agentMemoryMax = "5G";
-      claudeCodePackage = pkgs.unstable.claude-code;
-      buildSlots = 2;
-    };
-  };
-
-  # `otelCredential` is root:root 0600, so the interactive `claude` an admin
-  # runs as themselves cannot read it — only the hive's agent units can, via
-  # LoadCredential. Hand each admin their own copy so the wrapper in
-  # homeConfigurations/muede/claude.nix can pick it up. It lands in /run
-  # (tmpfs) rather than the nix store because the store is world-readable, and
-  # rather than /etc because the header should not outlive a reboot.
-  config.systemd.services.claude-otel-user-header = lib.mkIf cfg.enable {
-    description = "Expose the hive OTLP auth header to interactive admin users";
-    wantedBy = [ "multi-user.target" ];
-    unitConfig.ConditionPathExists = otelCredential;
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      RuntimeDirectory = runtimeDirName;
-      # Traversable by everyone; the per-user files inside are the 0400 part.
-      RuntimeDirectoryMode = "0755";
-      ExecStart = pkgs.writeShellScript "claude-otel-user-header" ''
-        set -eu
-        umask 077
-        for user in ${lib.escapeShellArgs adminUsers}; do
-          ${lib.getExe' pkgs.coreutils "install"} -m0400 -o "$user" -g root \
-            ${lib.escapeShellArg otelCredential} "$RUNTIME_DIRECTORY/$user"
-        done
-      '';
-    };
-  };
-}