{
  hyperhive,
  pkgs,
  lib,
  config,
  ...
}:
let
  cfg = config.my.constellation-swarm;
  adminUsers = [ "muede" ];
  otelCredential = "/etc/hyperhive/otel-cred";
  runtimeDirName = "claude-otel";
in
{
  options.my.constellation-swarm = {
    enable = lib.mkEnableOption "hyperhive / constellation swarm";
    hiveName = lib.mkOption { type = lib.types.str; };

    userOtelHeaderDir = lib.mkOption {
      type = lib.types.str;
      default = "/run/${runtimeDirName}";
      readOnly = true;
      description = ''
        Directory holding the per-admin copies of the hive's OTLP auth header,
        one 0400 file per user named after them. Read-only so the home-manager
        side (homeConfigurations/muede/claude.nix) can point at it via
        `osConfig` instead of repeating the path.
      '';
    };
  };

  imports = [ hyperhive.nixosModules.default ];

  config.services.hyperhive = lib.mkIf cfg.enable {
    enable = true;
    swarm = {
      name = "constellation";
      domain = "constellation.darkest.space";
      enableRequiredServices = true;
      forge.ci = {
        enable = true;
        concurrency = 2;
      };
      matrix = {
        # not default - both still on hive domain
        gatewayHost = "matrix.pr1ma.darkest.space";
        serverName = "pr1ma.darkest.space";
      };
      hives = {
        "umbra" = {
          # not default - still not subdomain
          domain = "umbra.darkest.space";
        };
        "pr1ma" = {
          # not default - still not subdomain
          domain = "pr1ma.darkest.space";
        };
      };
    };
    ruthless = true;
    hiveName = cfg.hiveName;
    gateway = {
      localHostsEntry = true;
      openFirewall = true;
    };
    otel = {
      enable = true;
      endpoint = "https://exponentials.vibec0re.mov/otel";
      headersCredential = otelCredential;
    };
    c0re = {
      inherit adminUsers;
      agentMemoryMax = "6G";
      claudeCodePackage = pkgs.unstable.claude-code;
      buildSlots = 2;
    };
  };

  # `otelCredential` is root:root 0600, so the interactive `claude` an admin
  # runs as themselves cannot read it — only the hive's agent units can, via
  # LoadCredential. Hand each admin their own copy so the wrapper in
  # homeConfigurations/muede/claude.nix can pick it up. It lands in /run
  # (tmpfs) rather than the nix store because the store is world-readable, and
  # rather than /etc because the header should not outlive a reboot.
  config.systemd.services.claude-otel-user-header = lib.mkIf cfg.enable {
    description = "Expose the hive OTLP auth header to interactive admin users";
    wantedBy = [ "multi-user.target" ];
    unitConfig.ConditionPathExists = otelCredential;
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      RuntimeDirectory = runtimeDirName;
      # Traversable by everyone; the per-user files inside are the 0400 part.
      RuntimeDirectoryMode = "0755";
      ExecStart = pkgs.writeShellScript "claude-otel-user-header" ''
        set -eu
        umask 077
        for user in ${lib.escapeShellArgs adminUsers}; do
          ${pkgs.coreutils}/bin/install -m0400 -o "$user" -g root \
            ${lib.escapeShellArg otelCredential} "$RUNTIME_DIRECTORY/$user"
        done
      '';
    };
  };
}