metrics to exponentials for local claude

nixosModules/constellation-swarm.nix

@@ -7,11 +7,26 @@
 }:
 let
   cfg = config.my.constellation-swarm;
+  adminUsers = [ "muede" ];
+  otelCredential = "/etc/hyperhive/otel-cred";
+  runtimeDirName = "claude-otel";
 in
 {
   options.my.constellation-swarm = {
     enable = lib.mkEnableOption "hyperhive / constellation swarm";
     hiveName = lib.mkOption { type = lib.types.str; };
+
+    userOtelHeaderDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/run/${runtimeDirName}";
+      readOnly = true;
+      description = ''
+        Directory holding the per-admin copies of the hive's OTLP auth header,
+        one 0400 file per user named after them. Read-only so the home-manager
+        side (homeConfigurations/muede/claude.nix) can point at it via
+        `osConfig` instead of repeating the path.
+      '';
+    };
   };
 
   imports = [ hyperhive.nixosModules.default ];
@@ -39,12 +54,39 @@ in
     otel = {
       enable = true;
       endpoint = "https://exponentials.vibec0re.mov/otel";
-      headersCredential = "/etc/hyperhive/otel-cred";
+      headersCredential = otelCredential;
     };
     c0re = {
-      adminUsers = ["muede"];
+      inherit adminUsers;
       agentMemoryMax = "6G";
       claudeCodePackage = pkgs.unstable.claude-code;
     };
   };
+
+  # `otelCredential` is root:root 0600, so the interactive `claude` an admin
+  # runs as themselves cannot read it — only the hive's agent units can, via
+  # LoadCredential. Hand each admin their own copy so the wrapper in
+  # homeConfigurations/muede/claude.nix can pick it up. It lands in /run
+  # (tmpfs) rather than the nix store because the store is world-readable, and
+  # rather than /etc because the header should not outlive a reboot.
+  config.systemd.services.claude-otel-user-header = lib.mkIf cfg.enable {
+    description = "Expose the hive OTLP auth header to interactive admin users";
+    wantedBy = [ "multi-user.target" ];
+    unitConfig.ConditionPathExists = otelCredential;
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      RuntimeDirectory = runtimeDirName;
+      # Traversable by everyone; the per-user files inside are the 0400 part.
+      RuntimeDirectoryMode = "0755";
+      ExecStart = pkgs.writeShellScript "claude-otel-user-header" ''
+        set -eu
+        umask 077
+        for user in ${lib.escapeShellArgs adminUsers}; do
+          ${pkgs.coreutils}/bin/install -m0400 -o "$user" -g root \
+            ${lib.escapeShellArg otelCredential} "$RUNTIME_DIRECTORY/$user"
+        done
+      '';
+    };
+  };
 }