Merge remote changes + feat: AIO v2 board module
- Cross-compile overlays for Hyprland (libcamera, pipewire, gjs) - Refactor uconsoleBaseModules into reusable list - Add wireguard-client service module - Restructure users into subdirectories - New: hardware.uconsole-cm5-aio-v2 module (GPIO rails, aiov2_ctl, GPS UART) - Update configuration.nix with Hyprland + AIO v2 - Add AIO v2 module to both toplevel and SD image config
This commit is contained in:
@@ -49,24 +49,12 @@
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
networking.hostId = "deadbeef";
|
||||
|
||||
# WireGuard VPN client -- always up, connects to wg-easy server
|
||||
# Create age-encrypted secrets before deploying (run on the host):
|
||||
# echo -n "<private_key>" | agenix -e secrets/wireguard_private_key.age
|
||||
# echo -n "<preshared_key>" | agenix -e secrets/wireguard_preshared_key.age
|
||||
networking.wireguard.interfaces = {
|
||||
wg0 = {
|
||||
ips = [ "10.8.0.3/24" ];
|
||||
privateKeyFile = config.age.secrets.wireguard_private_key.path;
|
||||
peers = [
|
||||
{
|
||||
publicKey = "rY9zII3AOm8rog2rv02PyA3Bq7zdvTOGkZapfCV1DkE=";
|
||||
presharedKeyFile = config.age.secrets.wireguard_preshared_key.path;
|
||||
allowedIPs = [ "10.8.0.0/24" ];
|
||||
endpoint = "vpn.lazyworkhorse.net:51820";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
# WireGuard VPN client -- module, always up, connects to wg-easy server
|
||||
gortium.wireguard-client = {
|
||||
enable = true;
|
||||
vpnIp = "10.8.0.3/24";
|
||||
privateKeyFile = config.age.secrets.wireguard_private_key.path;
|
||||
presharedKeyFile = config.age.secrets.wireguard_preshared_key.path;
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
feat: add Hyperspace Pods NixOS module
|
||||
|
||||
Create modules/nixos/services/hyperspace.nix for the Hyperspace Pods
|
||||
P2P AI cluster agent. Registered in flake.nix under lazyworkhorse.
|
||||
|
||||
- Fetches CLI binary v5.45.30 via fetchurl with SRI hash verification
|
||||
- Systemd system service: auto profile, configurable api port 8080,
|
||||
ai-worker user, GPU device access (kfd+dri), SupplementaryGroups
|
||||
for video+render groups, service hardening
|
||||
- Firewall: TCP 4001 libp2p, 30301 chain, 8080 API; UDP 4001 libp2p
|
||||
- AMD MI50 ROCm via HSA_OVERRIDE_GFX_VERSION=9.0.6
|
||||
- Adds video+render groups to ai-worker for persistent GPU access
|
||||
@@ -1,134 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.hyperspace;
|
||||
|
||||
hyperspacePkg = pkgs.stdenv.mkDerivation {
|
||||
name = "hyperspace-pods-${cfg.version}";
|
||||
src = pkgs.fetchurl {
|
||||
url = "https://github.com/hyperspaceai/aios-cli/releases/download/v${cfg.version}/aios-cli-x86_64-unknown-linux-gnu.tar.gz";
|
||||
hash = cfg.packageHash;
|
||||
};
|
||||
sourceRoot = ".";
|
||||
installPhase = ''
|
||||
mkdir -p $out/libexec $out/bin
|
||||
cp -r * $out/libexec/
|
||||
chmod +x $out/libexec/aios-cli
|
||||
ln -s $out/libexec/aios-cli $out/bin/hyperspace
|
||||
'';
|
||||
};
|
||||
in {
|
||||
options.services.hyperspace = {
|
||||
enable = lib.mkEnableOption "Hyperspace Pods P2P AI cluster agent";
|
||||
|
||||
version = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "5.45.30";
|
||||
description = "Hyperspace CLI version to download.";
|
||||
};
|
||||
|
||||
packageHash = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "sha256-f6fJ8t3exqtYwUD5j+WvD+Hm0oN/Eef0X+R9Rj23dE0=";
|
||||
description = ''
|
||||
SRI hash of the hyperspace release tarball (sha256-<base64>).
|
||||
Must be updated when version changes. Generate with:
|
||||
nix store prefetch-file --hash-algo sha256 \\
|
||||
https://github.com/hyperspaceai/aios-cli/releases/download/v{version}/aios-cli-x86_64-unknown-linux-gnu.tar.gz
|
||||
'';
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "ai-worker";
|
||||
description = "System user to run the Hyperspace agent.";
|
||||
};
|
||||
|
||||
apiPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 8080;
|
||||
description = "OpenAI-compatible API port (configurable via --api-port).";
|
||||
};
|
||||
|
||||
profile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "auto";
|
||||
description = ''
|
||||
Agent profile. Options: auto (auto-detect hardware), full (all capabilities),
|
||||
inference (GPU inference only), embedding (CPU embedding only),
|
||||
relay (lightweight relay), storage (storage + memory).
|
||||
'';
|
||||
};
|
||||
|
||||
autoStart = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "Start the agent automatically on boot.";
|
||||
};
|
||||
|
||||
openFirewall = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "Open P2P mesh (4001 TCP+UDP, 30301 TCP) and API port in the firewall.";
|
||||
};
|
||||
|
||||
extraArgs = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "Extra arguments to pass to 'hyperspace start'.";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.hyperspace = {
|
||||
description = "Hyperspace Pods P2P AI Cluster Agent";
|
||||
after = [ "network.target" "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
wantedBy = lib.mkIf cfg.autoStart [ "multi-user.target" ];
|
||||
|
||||
path = with pkgs; [ bash coreutils ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = cfg.user;
|
||||
Group = cfg.user;
|
||||
WorkingDirectory = "${hyperspacePkg}/libexec";
|
||||
ExecStart = "${hyperspacePkg}/bin/hyperspace start --profile ${cfg.profile} --api-port ${toString cfg.apiPort} ${lib.escapeShellArgs cfg.extraArgs}";
|
||||
Restart = "on-failure";
|
||||
RestartSec = 5;
|
||||
|
||||
# AMD MI50 (ROCm) device access
|
||||
DeviceAllow = [ "/dev/kfd rw" "/dev/dri rw" ];
|
||||
|
||||
# Supplementary groups for GPU/accelerator access
|
||||
SupplementaryGroups = [ "video" "render" ];
|
||||
|
||||
# Hardening
|
||||
NoNewPrivileges = true;
|
||||
ProtectHome = "tmpfs";
|
||||
ProtectSystem = "strict";
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = false; # Needs /dev/kfd and /dev/dri
|
||||
};
|
||||
|
||||
environment = {
|
||||
HSA_OVERRIDE_GFX_VERSION = "9.0.6";
|
||||
HOME = "/home/${cfg.user}";
|
||||
};
|
||||
};
|
||||
|
||||
# Firewall ports for P2P mesh (libp2p 4001, chain 30301) and API
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 4001 30301 cfg.apiPort ];
|
||||
networking.firewall.allowedUDPPorts = lib.mkIf cfg.openFirewall [ 4001 ];
|
||||
|
||||
# Add GPU/accelerator groups to the service user (persistent beyond service restarts)
|
||||
users.users = lib.mkIf (cfg.user == "ai-worker") {
|
||||
ai-worker = {
|
||||
extraGroups = [ "video" "render" ];
|
||||
};
|
||||
};
|
||||
|
||||
# ROCm override for AMD MI50 (gfx906) compatibility
|
||||
environment.variables.HSA_OVERRIDE_GFX_VERSION = "9.0.6";
|
||||
};
|
||||
}
|
||||
@@ -20,12 +20,32 @@
|
||||
users.ai-worker.main
|
||||
];
|
||||
|
||||
# AI worker user (Hermes SSH access)
|
||||
users.users.ai-worker = {
|
||||
isNormalUser = false;
|
||||
shell = pkgs.bash;
|
||||
openssh.authorizedKeys.keys = with keys; [
|
||||
users.ai-worker.main
|
||||
];
|
||||
};
|
||||
|
||||
# Age secret for gortium password (file created by user)
|
||||
age.secrets.gortium_password = {
|
||||
file = ../secrets/gortium_password.age;
|
||||
};
|
||||
|
||||
# WiFi via NetworkManager + secret agenix
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# Firmware
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
# Hyprland Wayland compositor (manual start — no SDDM)
|
||||
programs.hyprland = {
|
||||
enable = true;
|
||||
xwayland.enable = true;
|
||||
};
|
||||
|
||||
# HackerGadgets AIO v2 board
|
||||
hardware.uconsole-cm5-aio-v2 = {
|
||||
enable = true;
|
||||
|
||||
Reference in New Issue
Block a user