129 lines
4 KiB
Nix
129 lines
4 KiB
Nix
{
|
|
hyperhive,
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
adminUsers = [ "muede" ];
|
|
otelCredential = "/etc/hyperhive/otel-cred";
|
|
runtimeDirName = "claude-otel";
|
|
|
|
old = "forge.pr1ma.darkest.space";
|
|
new = "forge.constellation.darkest.space";
|
|
in
|
|
{
|
|
options.my.constellation-swarm.userOtelHeaderDir = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/run/${runtimeDirName}";
|
|
readOnly = true;
|
|
description = ''
|
|
Directory holding the per-admin copies of the hive's OTLP auth header,
|
|
one 0400 file per user named after them. Read-only so the home-manager
|
|
side (./claude.nix) can point at it via
|
|
`osConfig` instead of repeating the path.
|
|
'';
|
|
};
|
|
|
|
imports = [ hyperhive.nixosModules.default ];
|
|
|
|
config = {
|
|
services.hyperhive = {
|
|
swarm = {
|
|
name = "constellation";
|
|
domain = "constellation.darkest.space";
|
|
matrix = {
|
|
# not default - both still on hive domain
|
|
gatewayHost = "matrix.pr1ma.darkest.space";
|
|
serverName = "pr1ma.darkest.space";
|
|
};
|
|
hives = {
|
|
"umbra" = {
|
|
# not default - still not subdomain
|
|
domain = "umbra.darkest.space";
|
|
};
|
|
"pr1ma" = {
|
|
# not default - still not subdomain
|
|
domain = "pr1ma.darkest.space";
|
|
};
|
|
};
|
|
};
|
|
ruthless = true;
|
|
hiveName = "pr1ma";
|
|
gateway = {
|
|
localHostsEntry = true;
|
|
openFirewall = true;
|
|
# DNS: the hive's resolver must still answer for the old name, or
|
|
# nothing ever reaches the redirect. The forge module drops it from
|
|
# this list the moment you change `swarm.forge.domain`.
|
|
localNames = [ old ];
|
|
};
|
|
otel = {
|
|
enable = true;
|
|
endpoint = "https://exponentials.vibec0re.mov/otel";
|
|
headersCredential = otelCredential;
|
|
};
|
|
c0re = {
|
|
inherit adminUsers;
|
|
agentMemoryMax = "5G";
|
|
claudeCodePackage = pkgs.unstable.claude-code;
|
|
buildSlots = 2;
|
|
};
|
|
deploy = {
|
|
hive-controller.enable = true;
|
|
singleHostSwarm = true;
|
|
ci-runner = {
|
|
enable = true;
|
|
concurrency = 2;
|
|
};
|
|
};
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts.${old} =
|
|
let
|
|
gw = config.services.hyperhive.gateway;
|
|
in
|
|
(gw.lib.tlsFor old)
|
|
// {
|
|
listen = gw.lib.listen;
|
|
locations."/".return = "301 https://${new}$request_uri";
|
|
};
|
|
};
|
|
|
|
# Needs the hive's otel config and the header service below, so it lives
|
|
# here rather than in the shared home config.
|
|
home-manager.users.muede.imports = [ ./claude.nix ];
|
|
|
|
#containers.swarm-authelia.config.services.authelia.instances.swarm.settings.log.level =lib.mkForce "debug";
|
|
|
|
# `otelCredential` is root:root 0600, so the interactive `claude` an admin
|
|
# runs as themselves cannot read it — only the hive's agent units can, via
|
|
# LoadCredential. Hand each admin their own copy so the wrapper in
|
|
# ./claude.nix can pick it up. It lands in /run
|
|
# (tmpfs) rather than the nix store because the store is world-readable, and
|
|
# rather than /etc because the header should not outlive a reboot.
|
|
systemd.services.claude-otel-user-header = {
|
|
description = "Expose the hive OTLP auth header to interactive admin users";
|
|
wantedBy = [ "multi-user.target" ];
|
|
unitConfig.ConditionPathExists = otelCredential;
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
RuntimeDirectory = runtimeDirName;
|
|
# Traversable by everyone; the per-user files inside are the 0400 part.
|
|
RuntimeDirectoryMode = "0755";
|
|
ExecStart = pkgs.writeShellScript "claude-otel-user-header" ''
|
|
set -eu
|
|
umask 077
|
|
for user in ${lib.escapeShellArgs adminUsers}; do
|
|
${lib.getExe' pkgs.coreutils "install"} -m0400 -o "$user" -g root \
|
|
${lib.escapeShellArg otelCredential} "$RUNTIME_DIRECTORY/$user"
|
|
done
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|