forked from DreamLab-AI/VisionClaw
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathflake.nix
More file actions
1673 lines (1527 loc) · 75.8 KB
/
flake.nix
File metadata and controls
1673 lines (1527 loc) · 75.8 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{
description = "Agentbox — modular sovereign multi-agent container";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
flake-utils.url = "github:numtide/flake-utils";
nix2container.url = "github:nlewo/nix2container";
rust-overlay.url = "github:oxalica/rust-overlay";
# D.9: skills corpus as a content-addressed Nix input.
# Currently a path-type input (file-system equivalent to ./skills).
# Future: flip to fetchFromGitHub once DreamLab-AI/agentbox-skills exists:
# skills.url = "github:DreamLab-AI/agentbox-skills/main";
# Then run: nix flake lock --update-input skills
skills = {
url = "path:./skills";
flake = false;
};
};
outputs = { self, nixpkgs, flake-utils, nix2container, rust-overlay, skills }:
flake-utils.lib.eachSystem [
"x86_64-linux"
"aarch64-linux"
"x86_64-darwin"
"aarch64-darwin"
] (system:
let
pkgs = import nixpkgs {
inherit system;
overlays = [ rust-overlay.overlays.default ];
config = {
allowUnfree = true;
# python3.12-ecdsa is flagged insecure upstream (timing-side-channel
# class; CVE class, not a concrete CVE). scripts/sovereign-bootstrap.py
# uses it only for local secp256k1 keypair generation + bech32
# encoding, not on any remote-attacker-observable path. The signing
# hot path (NIP-98 verify, bridge signer) uses @noble/curves via
# nostr-tools in management-api, which is constant-time. Tracking
# upstream for an ecdsa bump or nixpkgs overlay replacement.
permittedInsecurePackages = [ "python3.12-ecdsa-0.19.1" ];
};
};
lib = pkgs.lib;
n2c = nix2container.packages.${system}.nix2container;
agentboxConfig = builtins.fromTOML (builtins.readFile ./agentbox.toml);
coreCfg = agentboxConfig.core or {};
sovereignCfg = agentboxConfig.sovereign_mesh or {};
desktopCfg = agentboxConfig.desktop or {};
skillsCfg = agentboxConfig.skills or {};
toolchainCfg = agentboxConfig.toolchains or {};
browserCfg = skillsCfg.browser or {};
mediaCfg = skillsCfg.media or {};
spatialCfg = skillsCfg.spatial_and_3d or {};
dataScienceCfg = skillsCfg.data_science or {};
docsCfg = skillsCfg.docs or {};
securityCfg = agentboxConfig.security or {};
securityExceptions = securityCfg.exceptions or {};
privacyFilterCfg = agentboxConfig.privacy_filter or {};
relayCfg = (sovereignCfg.relay or {});
adaptersCfgTop = agentboxConfig.adapters or {};
solidPodRsCfg = (agentboxConfig.integrations or {}).solid_pod_rs or {};
podsImpl = adaptersCfgTop.pods or "local-solid-rs";
solidPodRsActive = podsImpl == "local-solid-rs";
# GPU backend dispatch — single source of truth for GPU concerns.
gpuLib = import ./lib/gpu-backend.nix { inherit lib pkgs; };
gpuCfg = gpuLib.dispatchGpuBackend
(agentboxConfig.gpu.backend or "none")
(toolchainCfg.cuda or false);
# ---------------------------------------------------------------------------
# PRD-002 §9 Phase 2 — global npm CLI derivations via lib/npm-cli.nix.
#
# Each entry replaces a `npm install -g` call that was previously in
# config/entrypoint-unified.sh Phase 7. All versions are exact semver pins;
# ^ / ~ are disallowed. sha256 values are SRI hashes of the registry .tgz.
#
# Packages using lib.fakeHash will throw at evaluation time with the exact
# nix-prefetch-url command needed to obtain the real hash (see makeNpmCli).
#
# Version-bump procedure (applies to all entries):
# 1. Update version = "..." below.
# 2. Run: nix-prefetch-url https://registry.npmjs.org/<pkg>/-/<basename>-<ver>.tgz
# then: nix hash to-sri --type sha256 <base32>
# 3. Replace the sha256 value.
# Renovate custom-managers in renovate.json automate step 1.
# ---------------------------------------------------------------------------
npmCliLib = import ./lib/npm-cli.nix { inherit lib pkgs; };
mkNpmCli = npmCliLib.makeNpmCli;
# 1. ruvector — always enabled; replaces npx in [program:ruvector] supervisor block.
# nix-prefetch-url https://registry.npmjs.org/ruvector/-/ruvector-0.2.23.tgz
ruvectorPkg = mkNpmCli {
pkgName = "ruvector";
version = "0.2.23";
sha256 = "sha256-IUSAj/MLpdBt2N/joQ1n6QM/u5gVA+1CMCO++hV+dfY=";
nodeModulesHash = "sha256-eQBvPsAm5qzJBvQWjdLMLK26XKZGdyXwPTA0GKU8kno=";
bin = "ruvector";
};
# 2. @claude-flow/cli — gated by toolchains.claude_flow.
# nix-prefetch-url https://registry.npmjs.org/%40claude-flow/cli/-/cli-3.5.80.tgz
claudeFlowPkg = mkNpmCli {
pkgName = "@claude-flow/cli";
version = "3.5.80";
sha256 = "sha256-7egZQtT2iKVXtrPWByc1zk9/TLbcDKO1nr+B+sqeQ88=";
nodeModulesHash = "sha256-o9WSbydPpI60QG5MSlPzTvfXN3/oIzepWv6M84+6zuo=";
bin = "claude-flow";
};
# 3. ruflo — gated by toolchains.ruflo.
# nix-prefetch-url https://registry.npmjs.org/ruflo/-/ruflo-3.5.80.tgz
rufloPkg = mkNpmCli {
pkgName = "ruflo";
version = "3.5.80";
sha256 = "sha256-7/e9G/Ggm+MB6TwAEnxUZ7pe9qCDp5qrm5v4fF6fq4I=";
nodeModulesHash = "sha256-780nEnVhIa51tyfozBPukKeODuWjg2CIIUeRoKAi0tI=";
bin = "ruflo";
};
# 4. agentic-qe — gated by toolchains.agentic_qe.
# DEFERRED SIDE EFFECT: `aqe init --auto` writes user config and agent
# templates to $HOME/.claude/agents/ — it must run as the runtime user
# after container start, NOT at Nix build time. Add to agentbox.sh init:
# [[ "${ENABLE_AGENTIC_QE:-false}" == "true" ]] && aqe init --auto || true
# nix-prefetch-url https://registry.npmjs.org/agentic-qe/-/agentic-qe-3.9.15.tgz
agenticQePkg = mkNpmCli {
pkgName = "agentic-qe";
version = "3.9.15";
sha256 = "sha256-9CjwZt9bbJCIxyR8qy1snrXdAIAppxMiqwg5NooukVg=";
nodeModulesHash = "sha256-NKSf7vrWE74DJKdRRKggmfoxY1EkDz1qRGWrH8jOUwE=";
bin = "aqe";
};
# 5. nagual-qe — gated by toolchains.nagual_qe.
# Built from source via lib/nagual-qe.nix (Rust crate, not on npm).
# See that file for version/rev pinning + Cargo feature defaults.
# Definition lives further down alongside solid-pod-rs (matched
# Rust-build pattern).
# 6. codebase-memory-mcp — gated by toolchains.codebase_memory.
# nix-prefetch-url https://registry.npmjs.org/codebase-memory-mcp/-/codebase-memory-mcp-0.6.0.tgz
codebaseMemoryPkg = mkNpmCli {
pkgName = "codebase-memory-mcp";
version = "0.6.0";
sha256 = "sha256-aZ2msekZEaO/CHAGSLiFtkyZKNZnEhCVNOyKVEf3FYk=";
nodeModulesHash = "sha256-r9XtljjygaBEsRwCKKyd8KM5WWDVovz66SB0StudBE8=";
bin = "codebase-memory-mcp";
};
# 7. agent-browser — gated by skills.browser.agent_browser.
# CHROME_PATH injected via extraEnv so agent-browser finds Nix-store Chromium.
# nix-prefetch-url https://registry.npmjs.org/agent-browser/-/agent-browser-0.26.0.tgz
agentBrowserPkg = mkNpmCli {
pkgName = "agent-browser";
version = "0.26.0";
sha256 = "sha256-ikjPQRDX3CwSwcTW0l4Lq9+jFgS1N/Bd8NyDX+L4VL8=";
nodeModulesHash = "sha256-UH8DzadtsBJZXyrDxlVdhECqCnjLrHmu/9KQoGT0/Ds=";
bin = "agent-browser";
extraEnv = {
CHROME_PATH = "${pkgs.chromium}/bin/chromium";
};
};
# 8. playwright CLI — gated by skills.browser.playwright.
# PLAYWRIGHT_BROWSERS_PATH uses nixpkgs browsers; no download at runtime.
# Distinct from skills/playwright/mcp-server (local project, Phase 1).
# nix-prefetch-url https://registry.npmjs.org/playwright/-/playwright-1.59.1.tgz
playwrightCliPkg = mkNpmCli {
pkgName = "playwright";
version = "1.59.1";
sha256 = "sha256-emiKclkp8jJbNFmXhFscpQrOd5jnauSbYVFvg+CDiO8=";
nodeModulesHash = "sha256-Tza83dU5GfNrV+MqZpfmIhBa3t0LLq1YLRgsO2St4U8=";
bin = "playwright";
extraEnv = {
PLAYWRIGHT_BROWSERS_PATH = "${pkgs.playwright-driver.browsers}";
};
};
# 9. @mermaid-js/mermaid-cli — gated by skills.docs.mermaid.
# Binary name is mmdc (upstream convention).
# nix-prefetch-url https://registry.npmjs.org/%40mermaid-js/mermaid-cli/-/mermaid-cli-11.12.0.tgz
mermaidCliPkg = mkNpmCli {
pkgName = "@mermaid-js/mermaid-cli";
version = "11.12.0";
sha256 = "sha256-xZ4rfsAQ16J6RbSt3N6Xl4xkSx6ZZgnjlxTqUtiSaDc=";
nodeModulesHash = "sha256-yPmuT8irpdqxR3RrGcm43eT/Dnz56VURy0EWi2jZVQg=";
bin = "mmdc";
};
# ruvector is always included; rest are feature-gated. nagual-qe is
# NOT in this list — it is a Rust source build wired via nagualQePkg
# alongside solid-pod-rs (see further down) and added to the package
# set via nagualQePackages.
npmCliAlwaysPackages = [ ruvectorPkg ];
npmCliGatedPackages =
lib.optionals (toolchainCfg.claude_flow or false) [ claudeFlowPkg ]
++ lib.optionals (toolchainCfg.ruflo or false) [ rufloPkg ]
++ lib.optionals (toolchainCfg.agentic_qe or false) [ agenticQePkg ]
++ lib.optionals (toolchainCfg.codebase_memory or false) [ codebaseMemoryPkg ]
++ lib.optionals (browserCfg.agent_browser or false) [ agentBrowserPkg ]
++ lib.optionals (browserCfg.playwright or false) [ playwrightCliPkg ]
++ lib.optionals (docsCfg.mermaid or false) [ mermaidCliPkg ];
# 3DGS stack — gated by gaussian_splatting + local-cuda (E006).
gs3dLib = import ./lib/3dgs-stack.nix { inherit lib pkgs; };
gauss3dPackages = lib.optionals (spatialCfg.gaussian_splatting or false)
(gs3dLib.makeGaussianSplattingPackages { inherit system; });
# ---------------------------------------------------------------------------
# PRD-002 §9 Phase 1 — local npm service derivations via buildNpmPackage.
#
# npmDepsHash values must be computed by the operator before first build:
# nix run nixpkgs#prefetch-npm-deps -- <service>/package-lock.json
#
# Each service that still carries lib.fakeHash will throw at evaluation
# time with the exact resolver command (see lib/npm-services.nix).
# ---------------------------------------------------------------------------
npmServicesLib = import ./lib/npm-services.nix { inherit lib pkgs; };
# 1. management-api — always-on; 18 prod deps (fastify + otel + prom-client)
managementApiPkg = npmServicesLib.makeNpmService {
name = "management-api";
src = ./management-api;
entry = "server.js";
# Prefetched 2026-04-24 against management-api/package-lock.json.
# Refresh via: nix run nixpkgs#prefetch-npm-deps -- management-api/package-lock.json
# Prefetched 2026-04-27. Refresh: nix run nixpkgs#prefetch-npm-deps -- management-api/package-lock.json
npmDepsHash = "sha256-KSyQJIMlbZHm2qWaw7Djpi4tJ4Zfm9st+umvHJuwrD8=";
};
# 2. mcp/nostr-bridge — sovereign_mesh service; 2 deps (nostr-tools, ws)
nostrBridgePkg = npmServicesLib.makeNpmService {
name = "nostr-bridge";
src = ./mcp;
entry = "servers/nostr-bridge.js";
# Prefetched 2026-04-24 after regenerating mcp/package-lock.json
# (the shipped lockfile predated the nostr-tools dep addition).
# Refresh: nix run nixpkgs#prefetch-npm-deps -- mcp/package-lock.json
npmDepsHash = "sha256-/+arrMvbSbUKlX6EFdoXQv5oh5p3UDgns3eGX+UG0nM=";
};
# 3. skills/openai-codex/mcp-server — gated by toolchains.codex
codexMcpPkg = npmServicesLib.makeNpmService {
name = "openai-codex-mcp";
src = ./skills/openai-codex/mcp-server;
entry = "server.js";
# Prefetched 2026-04-24. Refresh: nix run nixpkgs#prefetch-npm-deps -- skills/openai-codex/mcp-server/package-lock.json
npmDepsHash = "sha256-lDX5EgJ/41iC9NjYgJ8w5VAUP3AlgIwY5tmJE0MGgI4=";
};
# 4. skills/lazy-fetch/mcp-server — gated by toolchains.ruflo or claude_flow.
# TypeScript source: buildPhaseExtra runs tsc; output is dist/mcp-server.js.
lazyFetchMcpPkg = npmServicesLib.makeNpmService {
name = "lazy-fetch-mcp";
src = ./skills/lazy-fetch/mcp-server;
entry = "dist/mcp-server.js";
# QE audit P0: `npx --yes tsc` attempts to fetch typescript from npm
# which fails in the Nix sandbox (network disabled). Provide tsc via
# nativeBuildInputs instead — typescript comes from nixpkgs, not npm.
extraBuildInputs = [ pkgs.typescript ];
buildPhaseExtra = ''
export HOME="$TMPDIR"
tsc --project tsconfig.json
'';
# Prefetched 2026-04-24. Refresh: nix run nixpkgs#prefetch-npm-deps -- skills/lazy-fetch/mcp-server/package-lock.json
npmDepsHash = "sha256-Bh72Bvdqmqnyqoleqmmofp2feMspGOu6+xnfCz3xIbY=";
};
# 5. skills/playwright/mcp-server — gated by skills.browser.playwright.
# PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 prevents the npm postinstall script
# from fetching browsers; browsers are supplied by pkgs.playwright-driver.browsers.
playwrightMcpPkg = npmServicesLib.makeNpmService {
name = "playwright-mcp";
src = ./skills/playwright/mcp-server;
entry = "server.js";
extraEnv = { PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1"; };
# Prefetched 2026-04-24. Refresh: nix run nixpkgs#prefetch-npm-deps -- skills/playwright/mcp-server/package-lock.json
npmDepsHash = "sha256-Ix5YV1W54KYyc5fGS1DjpyfrUlX1Qjzt6cJcPetT7wM=";
};
# 7. mcp/consultants — consultant tier (PRD-005 / ADR-011). Single
# buildNpmPackage with five bin entries; ships when consultants.enabled
# = true. Each individual consultant is gated separately at runtime via
# the manifest's [consultants.<name>].enabled flag, but they share one
# node_modules tree because the shared/ scaffolding is internal-only.
consultantsPkg = npmServicesLib.makeNpmService {
name = "agentbox-consultants";
src = ./mcp/consultants;
entry = "shared/consultant-base.js"; # smoke-load target
# Prefetched 2026-04-25. Refresh:
# nix run nixpkgs#prefetch-npm-deps -- mcp/consultants/package-lock.json
# Prefetched 2026-04-25. Refresh: nix run nixpkgs#prefetch-npm-deps -- mcp/consultants/package-lock.json
npmDepsHash = "sha256-ph18TjfLha5ltqsqo1d2cjrqqYS6jB+FD0DlNqyG0Hw=";
};
# 6. skills/comfyui/mcp-server — gated by skills.media.comfyui_builtin.
# sharp has native gyp bindings; python3 + nodeGyp are required to rebuild
# it against the Nix libc.
comfyuiMcpPkg = npmServicesLib.makeNpmService {
name = "comfyui-mcp";
src = ./skills/comfyui/mcp-server;
entry = "server.js";
skipLoadCheck = true;
extraBuildInputs = [ pkgs.python3 pkgs.node-gyp ];
extraEnv = { npm_config_build_from_source = "true"; };
# Prefetched 2026-04-24. Refresh: nix run nixpkgs#prefetch-npm-deps -- skills/comfyui/mcp-server/package-lock.json
npmDepsHash = "sha256-3OchWVs/H+swo4KzBcicvs0+4FW8RVNDqc4DrmC81Xc=";
};
# Conditional package lists for allPackages — mirrors the lib.optionals
# pattern used for codexPackages, geminiCliPackages, etc.
npmServicePackages =
# management-api is always included
[ managementApiPkg ]
# nostr-bridge: when sovereign_mesh.enabled (same gate as supervisord block)
++ lib.optionals (sovereignCfg.enabled or false) [ nostrBridgePkg ]
# openai-codex MCP server: when toolchains.codex enabled
++ lib.optionals (toolchainCfg.codex or false) [ codexMcpPkg ]
# lazy-fetch MCP: when ruflo or claude_flow enabled
++ lib.optionals ((toolchainCfg.ruflo or false) || (toolchainCfg.claude_flow or false)) [ lazyFetchMcpPkg ]
# playwright MCP: when skills.browser.playwright enabled
++ lib.optionals (browserCfg.playwright or false) [ playwrightMcpPkg ]
# comfyui MCP: when skills.media.comfyui_builtin enabled
++ lib.optionals (mediaCfg.comfyui_builtin or false) [ comfyuiMcpPkg ]
# Consultants: ship the full bundle when the master gate is on.
# Per-consultant runtime gating lives in [consultants.<name>].enabled.
++ lib.optionals ((agentboxConfig.consultants or {}).enabled or false) [ consultantsPkg ];
boolEnv = value: if value then "true" else "false";
basePackages = with pkgs; [
bash
fish
sudo
coreutils
cacert
curl
wget
git
git-lfs
gh
jq
ripgrep
fd
gnugrep
gnused
gawk
findutils
which
less
file
tree
tmux
vim
nano
unzip
zip
gzip
xz
htop
ncdu
ncurses # provides clear, tput, reset, infocmp, tic — terminal handling
procps
openssh
inetutils # hostname, telnet, ftp, traceroute — minimal network diagnostics
iproute2 # ip, ss — modern network introspection
iputils # ping, ping6, tracepath — basic reachability tests
gnumake
gcc
clang
cmake
pkg-config
uv
pandoc
# Modern CLI replacements (DX tooling for agentic engineers)
eza # modern ls with git integration
bat # cat with syntax highlighting
delta # better git diff viewer
dust # visual disk usage (du replacement)
procs # ps replacement with colour + tree
sd # sed replacement with simpler syntax
choose # cut replacement, human-friendly field selection
tokei # fast code statistics
bottom # resource monitor (btop alternative)
zoxide # smart cd that learns directories
starship # cross-shell prompt (git, nix, rust, node indicators)
atuin # shell history with fuzzy search + sync
fzf # fuzzy finder — Ctrl-R, Ctrl-T, piping
direnv # per-directory environment variables
nushell # structured data shell (JSON/TOML piping)
# Dev essentials
yq-go # YAML processor (jq for YAML)
hyperfine # command benchmarking
watchexec # file watcher + command runner
just # modern make replacement
];
nodeEnvPackages = with pkgs; [
nodejs_20
nodejs_20
yarn
pnpm
];
geminiCliPackages = lib.optionals (toolchainCfg.gemini_cli or false) [
pkgs.gemini-cli
];
# OpenAI Codex Rust-native CLI — pinned upstream release asset.
# See lib/codex-binary.nix for the per-arch sha256s and version bump
# procedure. Binary is statically linked (musl) so no runtime deps
# are required beyond what the container already has.
codexLib = import ./lib/codex-binary.nix { inherit lib pkgs; };
codexPackages = lib.optionals
((toolchainCfg.codex or false) && pkgs.stdenv.isLinux)
[ (codexLib.makeCodex system) ];
# Anthropic Claude Code native CLI — pinned upstream release binary.
# See lib/claude-code-binary.nix for the per-arch sha256s and version
# bump procedure. Binary is wrapped with makeBinaryWrapper to disable
# the auto-updater and inject runtime PATH deps (ripgrep, bubblewrap).
claudeCodeLib = import ./lib/claude-code-binary.nix { inherit lib pkgs; };
claudeCodePackages = lib.optionals
((toolchainCfg.claude_code or false) && pkgs.stdenv.isLinux)
[ (claudeCodeLib.makeClaudeCode system) ];
# Runtime Python environment for bootstrap scripts and local helpers.
# Use python.withPackages so every dep is on the interpreter's import
# path inside the container — listing them as standalone derivations
# in `allPackages` only puts them on $PATH and leaves
# `import ecdsa` failing with ModuleNotFoundError at bootstrap time
# (which crash-loops the container on first start).
# sovereign-bootstrap.py imports ecdsa directly; provision-agent-stacks.py
# imports yaml, requests, etc. — all must resolve via this interpreter.
pythonRuntimeEnv = pkgs.python312.withPackages (ps: with ps; [
pip
virtualenv
supervisor
requests
httpx
aiohttp
aiofiles
pyyaml
pydantic
rich
ecdsa
numpy
pandas
matplotlib
seaborn
pymupdf
]);
pythonBasePackages = [
pythonRuntimeEnv
];
rustToolchain = pkgs.rust-bin.stable.latest.minimal.override {
extensions = [ "rust-src" "clippy" "rustfmt" ];
targets = [ "wasm32-unknown-unknown" ];
};
wasmPackages = with pkgs; [
wasm-pack
wasm-bindgen-cli
binaryen
];
dbPackages = with pkgs; [
sqlite
];
browserPackages = lib.optionals (browserCfg.agent_browser or false || browserCfg.playwright or false || browserCfg.qe_browser or false) (with pkgs; [
chromium
playwright-driver
at-spi2-atk
cups
mesa
libdrm
alsa-lib
nss
nspr
]);
# ComfyUI built-in: fetch upstream source and wrap with a Python env.
# Included only when skills.media.comfyui_builtin = true.
# Bump the rev + hash intentionally via a PR when upgrading.
comfyuiRev = "v0.3.27";
comfyuiHash = "sha256-UGM2nrxveSEPuZAFY+Os0R1z/eWzlm8viG7sobis498=";
_comfyuiGuard =
if mediaCfg.comfyui_builtin or false
&& comfyuiHash == "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
then throw ''
flake.nix: skills.media.comfyui_builtin is enabled but the ComfyUI source hash
is still the placeholder. To build the built-in ComfyUI path:
1. Run: nix-prefetch-url --unpack https://github.com/comfyanonymous/ComfyUI/archive/${comfyuiRev}.tar.gz
2. Replace comfyuiHash in flake.nix with the returned sha256.
Alternatively: set skills.media.comfyui_builtin = false and use
[integrations.comfyui_external] to point at a running ComfyUI instance.
''
else null;
comfyuiSrc = pkgs.fetchFromGitHub {
owner = "comfyanonymous";
repo = "ComfyUI";
rev = comfyuiRev;
hash = comfyuiHash;
};
comfyuiPythonEnv = pkgs.python312.withPackages (ps: with ps; [
torch
torchvision
torchaudio
aiohttp
einops
transformers
safetensors
pyyaml
pillow
scipy
tqdm
psutil
]);
comfyuiPackages = lib.optionals (mediaCfg.comfyui_builtin or false) [
comfyuiPythonEnv
];
mediaPackages = with pkgs;
lib.optionals (mediaCfg.ffmpeg or false) [ ffmpeg ]
++ lib.optionals (mediaCfg.imagemagick or false) [ imagemagick ]
++ comfyuiPackages;
spatialPackages =
lib.optionals (spatialCfg.qgis or false) [
pkgs.qgis
pkgs.python312Packages.pyqt5
]
++ lib.optionals (spatialCfg.blender or false) [
pkgs.blender
]
# 3DGS stack: only when gaussian_splatting=true (requires local-cuda via E006)
++ gauss3dPackages;
dataSciencePackages =
lib.optionals (dataScienceCfg.pytorch or false) [
pkgs.python312Packages.torch
]
++ lib.optionals (dataScienceCfg.jupyter or false) [
pkgs.python312Packages.numpy
pkgs.python312Packages.pandas
pkgs.python312Packages.jupyter
pkgs.python312Packages.jupyterlab
pkgs.python312Packages.notebook
pkgs.python312Packages.ipykernel
];
docsPackages =
lib.optionals ((docsCfg.latex or false) || (docsCfg.report_builder or false)) [
pkgs.texliveFull
pkgs.biber
];
# ---------------------------------------------------------------------------
# Privacy filter (ADR-008) — local openai/privacy-filter sidecar.
# Gate: privacy_filter.enabled = true.
# The sidecar loads the HF model once at startup and exposes /classify,
# /redact, /health, /metrics on privacy_filter.port (default 9092, loopback).
# Model weights are fetched on first boot via transformers/huggingface_hub
# and persisted under /workspace/.cache/huggingface; no network traffic
# after warm-up. BF16 on GPU, BF16 on CPU, or Q4 on CPU (transformers.js
# path is out-of-scope; this is the server path).
# ---------------------------------------------------------------------------
# ---------------------------------------------------------------------------
# solid-pod-rs — first-class Solid Protocol 0.11 server (ADR-010).
# Gate: adapters.pods = "local-solid-rs" (the default).
# Source: github.com/DreamLab-AI/solid-pod-rs (AGPL-3.0-only; binary-
# aggregation under AGPL §5 keeps agentbox MPL-2.0 — see
# docs/developer/licensing.md). Derivation module in lib/solid-pod-rs.nix
# uses fakeHash placeholders that surface prefetch commands at realisation.
# ---------------------------------------------------------------------------
solidPodRsLib = import ./lib/solid-pod-rs.nix { inherit lib pkgs; };
# Opt-in features layered on top of defaultFeatures in lib/solid-pod-rs.nix.
# did-nostr / webhook-signing / rate-limit / quota / jss-v04 are in the
# default set; opting out requires a source-level edit of that file.
# Library-crate features are addressed via the solid-pod-rs/<name>
# dep-path so cargo enables them on the workspace member when the
# server crate doesn't forward them.
solidPodRsExtraFeatures =
lib.optionals (solidPodRsCfg.enable_oidc or false) [ "solid-pod-rs/oidc" ]
++ lib.optionals (solidPodRsCfg.enable_dpop_cache or false) [ "solid-pod-rs/dpop-replay-cache" ]
++ lib.optionals ((solidPodRsCfg.storage or "fs") == "s3") [ "solid-pod-rs/s3-backend" ]
++ lib.optionals ((solidPodRsCfg.notifications or "websocket") == "webhook"
&& (solidPodRsCfg.enable_webhook_signing or true)) [
"solid-pod-rs/legacy-notifications"
];
solidPodRsPkg =
if solidPodRsActive
then solidPodRsLib.makeSolidPodRs { extraFeatures = solidPodRsExtraFeatures; }
else null;
solidPodRsPackages = lib.optionals solidPodRsActive [ solidPodRsPkg ];
# ---------------------------------------------------------------------------
# nagual-qe — Rust QE knowledge system (proffesor-for-testing/nagual-qe).
# Gate: toolchains.nagual_qe = true.
# Built from source — there is no npm publication. Lives next to
# solid-pod-rs because both are first-party Rust source builds via
# buildRustPackage with a hash-verified Cargo vendor FOD.
# ---------------------------------------------------------------------------
nagualQeLib = import ./lib/nagual-qe.nix { inherit lib pkgs; };
nagualQePkg =
if (toolchainCfg.nagual_qe or false)
then nagualQeLib.makeNagualQe { }
else null;
nagualQePackages = lib.optionals (toolchainCfg.nagual_qe or false) [ nagualQePkg ];
# ---------------------------------------------------------------------------
# Linked-Data context catalogue (PRD-006 / ADR-012 / DDD-004).
# Gate: linked_data.enabled = true.
# Materialises every pinned @context document into one read-only directory
# at /opt/agentbox/contexts/. The runtime resolver loads the index once
# at boot and never fetches a context document at runtime (DDD-004 §L09).
# ---------------------------------------------------------------------------
linkedDataCfg = agentboxConfig.linked_data or {};
linkedDataActive = (linkedDataCfg.enabled or false) == true;
linkedDataContexts = import ./lib/linked-data-contexts.nix { inherit lib pkgs; };
linkedDataPackages = lib.optionals linkedDataActive [ linkedDataContexts ];
# ---------------------------------------------------------------------------
# Linked-Object Viewer (S12, PRD-006 §15).
# Gate: linked_data.viewer.mode = "local-linkedobjects".
# First-implementation viewer; the slot accepts other implementations
# behind the same /lo/manifest.json contract (see PRD-006 §15.4 and
# docs/developer/browser-panes.md).
# ---------------------------------------------------------------------------
viewerCfg = linkedDataCfg.viewer or {};
viewerMode = viewerCfg.mode or "off";
viewerLocalActive = viewerMode == "local-linkedobjects";
linkedObjectsBrowserLib = import ./lib/linkedobjects-browser.nix { inherit lib pkgs; };
linkedObjectsBrowserPkg =
if viewerLocalActive
then linkedObjectsBrowserLib.makeLinkedObjectsBrowser { }
else null;
linkedObjectsBrowserPackages = lib.optionals viewerLocalActive [ linkedObjectsBrowserPkg ];
# ---------------------------------------------------------------------------
# Embedded Nostr relay (ADR-009 / PRD-004).
# Gate: sovereign_mesh.relay.enabled = true AND implementation in the
# Nix-packageable set {nostr-rs-relay, rnostr}. External / off variants
# do not add a package; external still publishes the supervisor block
# only as a bridge-side concern (no local WS process).
# ---------------------------------------------------------------------------
relayEnabled = relayCfg.enabled or false;
relayImpl = relayCfg.implementation or "nostr-rs-relay";
relayLocal = relayEnabled && (relayImpl == "nostr-rs-relay" || relayImpl == "rnostr");
# Fail-fast for rnostr until a reproducible nixpkgs source lands.
# nostr-rs-relay is in nixpkgs (v0.9.0 as of 2026-04); rnostr is not
# yet packaged upstream, so require the operator to vendor it.
_relayImplGuard =
if relayEnabled && relayImpl == "rnostr"
&& !(pkgs ? rnostr)
then throw ''
flake.nix: sovereign_mesh.relay.implementation="rnostr" but pkgs.rnostr
is not available in the pinned nixpkgs. Either:
(a) set implementation = "nostr-rs-relay" in agentbox.toml, or
(b) vendor rnostr via a flake input (see docs/developer/sovereign-mesh.md).
''
else null;
relayPkg =
if relayEnabled && relayImpl == "nostr-rs-relay" then pkgs.nostr-rs-relay
else if relayEnabled && relayImpl == "rnostr" then pkgs.rnostr
else null;
relayPackages = lib.optionals relayLocal (lib.filter (p: p != null) [ relayPkg ]);
# Render a config.toml for nostr-rs-relay from manifest fields.
# Consumed by the supervisor block at /etc/agentbox/nostr-relay.toml.
relayAllowedKinds = relayCfg.allowed_kinds or [ 1 1059 30078 27235 38000 38100 ];
relayAllowedKindsToml = lib.concatStringsSep ", " (map toString relayAllowedKinds);
relayAllowedPubkeys = relayCfg.allowed_pubkeys or [];
relayAllowedPubkeysToml =
if relayAllowedPubkeys == []
then ""
else "pubkey_whitelist = [ " + lib.concatStringsSep ", " (map (k: "\"${k}\"") relayAllowedPubkeys) + " ]\n";
relayNip42Auth =
if (relayCfg.ingress_policy or "allowlist") == "open" then "false" else "true";
relayConfigText = ''
# AUTO-GENERATED from agentbox.toml — do not edit by hand.
[info]
name = "agentbox-relay"
description = "${relayCfg.info_description or "Agentbox sovereign relay"}"
${lib.optionalString ((relayCfg.info_contact or "") != "") "contact = \"${relayCfg.info_contact}\""}
relay_url = "ws://${relayCfg.bind or "127.0.0.1"}:${toString (relayCfg.port or 7777)}/"
[network]
address = "${relayCfg.bind or "127.0.0.1"}"
port = ${toString (relayCfg.port or 7777)}
remote_ip_header = "x-forwarded-for"
ping_interval = 300
[database]
engine = "sqlite"
data_directory = "${relayCfg.data_dir or "/var/lib/nostr-relay"}"
in_memory = false
min_conn = 0
max_conn = 16
[limits]
messages_per_sec = ${toString (relayCfg.messages_per_sec or 5)}
subscriptions_per_min = 60
max_event_bytes = ${toString (relayCfg.max_event_bytes or 131072)}
max_ws_message_bytes = ${toString (relayCfg.max_event_bytes or 131072)}
max_ws_frame_bytes = ${toString (relayCfg.max_event_bytes or 131072)}
max_blocking_threads = 16
broadcast_buffer = 16384
event_persist_buffer = 4096
[authorization]
${relayAllowedPubkeysToml}nip42_auth = ${relayNip42Auth}
nip42_dms = ${if relayCfg.allow_nip04 or false then "true" else "false"}
[options]
reject_future_seconds = 1800
[retention]
# NIP-40 expiration is honoured in-code; this is the default fallback
# applied to events that do not declare an expiration tag.
default_days = ${toString (relayCfg.retention_days or 30)}
'';
privacyFilterEnabled = privacyFilterCfg.enabled or false;
privacyFilterPythonEnv = pkgs.python312.withPackages (ps: with ps; [
transformers
safetensors
tokenizers
torch
huggingface-hub
aiohttp
pyyaml
]);
privacyFilterPackages = lib.optionals privacyFilterEnabled [ privacyFilterPythonEnv ];
desktopPackages = lib.optionals (desktopCfg.enabled or false) (with pkgs; [
tigervnc # Xvnc: X server + VNC in one binary (correct XKB paths)
xorg.xkbcomp # runtime keymap compilation
xorg.xauth
xorg.xset
xorg.xdpyinfo
xorg.xprop
xorg.xwininfo
xorg.setxkbmap
xkeyboard_config
i3 # tiling WM — stable in Nix containers (openbox segfaults)
i3status # status bar for i3
dmenu # launcher for i3
xterm
xfce.xfce4-terminal
dejavu_fonts
liberation_ttf
noto-fonts-cjk-sans
fontconfig
xdotool
xclip
scrot
feh
pcmanfm
]);
allPackages =
basePackages
++ nodeEnvPackages
++ pythonBasePackages
++ [ rustToolchain ]
++ wasmPackages
++ dbPackages
++ browserPackages
++ mediaPackages
++ spatialPackages
++ dataSciencePackages
++ docsPackages
++ privacyFilterPackages
++ relayPackages
++ solidPodRsPackages
++ nagualQePackages
++ desktopPackages
++ geminiCliPackages
++ codexPackages
++ claudeCodePackages
++ gpuCfg.nixPackages
# PRD-002 §9 Phase 1 — pre-packaged local npm services (immutable bootstrap)
++ npmServicePackages
# PRD-002 §9 Phase 2 — global npm CLI derivations (replaces npm install -g)
++ npmCliAlwaysPackages
++ npmCliGatedPackages;
# D.9: skillsTree is sourced from inputs.skills (path-type input).
# Switching to a remote upstream is a one-line inputs change + flake.lock regen.
skillsTree = skills;
appRoot = pkgs.runCommand "agentbox-app-root" {} ''
mkdir -p $out/opt/agentbox
# PRD-002 Phase 1: npm services are copied from their Nix derivation
# outputs (which already contain baked-in node_modules) rather than
# from the raw source tree. The derivation $out/package symlink
# points at the full package directory including node_modules.
cp -rL ${managementApiPkg}/package $out/opt/agentbox/management-api
# mcp source tree is always copied (contains servers/, scripts/, config/).
# When sovereign_mesh is enabled, nostrBridgePkg overlays the mcp
# directory so its node_modules are present at runtime.
cp -r ${./mcp} $out/opt/agentbox/mcp
cp -r ${skillsTree} $out/opt/agentbox/skills
cp -r ${./scripts} $out/opt/agentbox/scripts
cp -r ${./config} $out/opt/agentbox/config
cp -r ${./https-bridge} $out/opt/agentbox/https-bridge
cp -r ${./docs} $out/opt/agentbox/docs
cp -r ${./aisp} $out/opt/agentbox/aisp
cp ${./agentbox.toml} $out/opt/agentbox/agentbox.toml
# Linked-Data context catalogue (PRD-006 / ADR-012). Always copied
# so [linked_data].enabled = true at runtime works without rebuild;
# when the master gate is off, the resolver never reads this dir.
mkdir -p $out/opt/agentbox/contexts
cp -rL ${linkedDataContexts}/. $out/opt/agentbox/contexts/
${lib.optionalString viewerLocalActive ''
# Linked-Object Viewer bundle (S12, PRD-006 §15). Mounted by
# management-api at the operator-configured /lo prefix.
mkdir -p $out/opt/agentbox/browser
cp -rL ${linkedObjectsBrowserPkg}/. $out/opt/agentbox/browser/
''}
# `cp -r` from the Nix store preserves the read-only store bits on
# every copied file, which blocks the subsequent node_modules and
# mcp-server overlays below with "Permission denied". Make the
# whole copied tree writable once before any overlay runs.
chmod -R u+w $out/opt/agentbox
${lib.optionalString (sovereignCfg.enabled or false) ''
cp -rL ${nostrBridgePkg}/package/node_modules $out/opt/agentbox/mcp/node_modules
''}
# Optional skills — copy derivation package trees (includes node_modules)
# when the corresponding feature gate is enabled.
${lib.optionalString (toolchainCfg.codex or false) ''
mkdir -p $out/opt/agentbox/skills/openai-codex
cp -rL ${codexMcpPkg}/package $out/opt/agentbox/skills/openai-codex/mcp-server
''}
${lib.optionalString ((toolchainCfg.ruflo or false) || (toolchainCfg.claude_flow or false)) ''
mkdir -p $out/opt/agentbox/skills/lazy-fetch
cp -rL ${lazyFetchMcpPkg}/package $out/opt/agentbox/skills/lazy-fetch/mcp-server
''}
${lib.optionalString (browserCfg.playwright or false) ''
mkdir -p $out/opt/agentbox/skills/playwright
cp -rL ${playwrightMcpPkg}/package $out/opt/agentbox/skills/playwright/mcp-server
''}
${lib.optionalString (mediaCfg.comfyui_builtin or false) ''
mkdir -p $out/opt/agentbox/skills/comfyui
cp -rL ${comfyuiMcpPkg}/package $out/opt/agentbox/skills/comfyui/mcp-server
''}
${lib.optionalString ((agentboxConfig.consultants or {}).enabled or false) ''
mkdir -p $out/opt/agentbox/mcp
cp -rL ${consultantsPkg}/package $out/opt/agentbox/mcp/consultants
''}
chmod +x $out/opt/agentbox/config/entrypoint-unified.sh
find $out/opt/agentbox/scripts -type f -name '*.sh' -exec chmod +x {} +
find $out/opt/agentbox/scripts -type f -name '*.py' -exec chmod +x {} +
find $out/opt/agentbox/mcp -maxdepth 2 -type f -name '*.js' -exec chmod +x {} +
'';
qgisServiceBlock = ''
[program:qgis-mcp]
command=${pkgs.python312}/bin/python3 -u /opt/agentbox/scripts/qgis_mcp_standalone.py
directory=/opt/agentbox/scripts
autostart=true
autorestart=true
priority=230
stdout_logfile=/var/log/qgis-mcp.log
stderr_logfile=/var/log/qgis-mcp.error.log
'';
blenderServiceBlock = ''
[program:blender-mcp]
command=${pkgs.nodejs_20}/bin/node /opt/agentbox/skills/blender/tools/blender-mcp-proxy.js
directory=/opt/agentbox/skills/blender/tools
environment=HOME="/workspace"
autostart=true
autorestart=true
priority=231
stdout_logfile=/var/log/blender-mcp.log
stderr_logfile=/var/log/blender-mcp.error.log
'';
jupyterServiceBlock = ''
[program:jupyter-lab]
command=${pkgs.python312Packages.jupyterlab}/bin/jupyter-lab --ip=0.0.0.0 --port=8888 --no-browser --ServerApp.token=
directory=/workspace
environment=HOME="/workspace"
autostart=true
autorestart=true
priority=232
stdout_logfile=/var/log/jupyter-lab.log
stderr_logfile=/var/log/jupyter-lab.error.log
'';
# Desktop via TigerVNC Xvnc — single binary replaces Xvfb + x11vnc.
# Xvnc builds xkbcomp paths into its own derivation closure, avoiding
# the XKB path mismatch that breaks standalone Xvfb in nix2container.
desktopBlocks = ''
[program:xvnc]
command=${pkgs.tigervnc}/bin/Xvnc :1 -geometry ${(desktopCfg.resolution or "1920x1080")} -depth 24 -SecurityTypes None -ac -pn -rfbport 5901 -localhost -rawkeyboard
autostart=true
autorestart=true
priority=40
stdout_logfile=/var/log/xvnc.log
stderr_logfile=/var/log/xvnc.error.log
[program:i3wm]
command=${pkgs.i3}/bin/i3
environment=DISPLAY=":1",HOME="/workspace"
autostart=true
autorestart=true
startsecs=3
priority=41
stdout_logfile=/var/log/i3wm.log
stderr_logfile=/var/log/i3wm.error.log
'';
supervisorText = ''
[supervisord]
nodaemon=true
logfile=/var/log/supervisord.log
pidfile=/var/run/supervisord.pid
childlogdir=/var/log/supervisor
[unix_http_server]
file=/var/run/supervisor.sock
chmod=0766
[supervisorctl]
serverurl=unix:///var/run/supervisor.sock
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
[program:bootstrap]
command=/opt/agentbox/config/entrypoint-unified.sh
environment=AGENTBOX_BOOTSTRAP_STAGE="B"
autostart=true
autorestart=false
startsecs=0
priority=5
stdout_logfile=/var/log/bootstrap.log
stderr_logfile=/var/log/bootstrap.error.log
# ruvector is a CLI/library tool, not a daemon — available on PATH as 'ruvector'
# The management-api uses it via embedded-ruvector adapter (sql.js in-process)
# or external-pg adapter (PostgreSQL connection). No supervisord service needed.
[program:management-api]
command=${managementApiPkg}/bin/management-api
directory=/opt/agentbox/management-api
environment=HOME="/workspace",MANAGEMENT_API_PORT="%(ENV_MANAGEMENT_API_PORT)s",MANAGEMENT_API_KEY="%(ENV_MANAGEMENT_API_KEY)s",MANAGEMENT_API_AUTH_MODE="%(ENV_MANAGEMENT_API_AUTH_MODE)s",AGENTBOX_REQUIRED_FOR_READINESS="true"
autostart=true
autorestart=true
priority=20
stdout_logfile=/var/log/management-api.log
stderr_logfile=/var/log/management-api.error.log
; Bootstrap seal — writes /run/agentbox/bootstrap.done once every program
; tagged AGENTBOX_REQUIRED_FOR_READINESS="true" has reached RUNNING. This is
; the signal that /ready consults. priority=99 ensures it runs last;
; autorestart=false makes it a one-shot. If it times out the sentinel is never
; written and /ready remains 503 (PRD-002 §9, DDD-001 BootstrapCompletion).
[program:bootstrap-seal]
command=/opt/agentbox/config/seal-bootstrap.sh
autostart=true
autorestart=false
startsecs=0
priority=99
environment=SUPERVISORD_CONF="/etc/supervisord.conf",BOOTSTRAP_SEAL_TIMEOUT="120"
stdout_logfile=/var/log/bootstrap-seal.log
stderr_logfile=/var/log/bootstrap-seal.error.log
${lib.optionalString ((sovereignCfg.enabled or false) && solidPodRsActive) ''
[program:solid-pod]
command=${solidPodRsPkg}/bin/solid-pod-rs-server
directory=${solidPodRsCfg.storage_root or "/var/lib/solid"}
environment=HOME="/workspace",JSS_HOST="${solidPodRsCfg.bind or "127.0.0.1"}",JSS_PORT="${toString (solidPodRsCfg.port or 8484)}",JSS_BASE_URL="${solidPodRsCfg.base_url or "http://127.0.0.1:8484"}",JSS_STORAGE_ROOT="${solidPodRsCfg.storage_root or "/var/lib/solid"}",JSS_LOG_LEVEL="${solidPodRsCfg.log_level or "info"}",RUST_LOG="${solidPodRsCfg.log_level or "info"}",JSS_ENABLE_DID_NOSTR="${boolEnv (solidPodRsCfg.enable_did_nostr or true)}",JSS_ENABLE_RATE_LIMIT="${boolEnv (solidPodRsCfg.enable_rate_limit or true)}",JSS_RATE_LIMIT_PER_SEC="${toString (solidPodRsCfg.rate_limit_per_sec or 20)}",JSS_ENABLE_QUOTA="${boolEnv (solidPodRsCfg.enable_quota or true)}",JSS_QUOTA_DEFAULT_BYTES="${toString (solidPodRsCfg.quota_default_bytes or 10737418240)}",JSS_ENABLE_WEBHOOK_SIGNING="${boolEnv (solidPodRsCfg.enable_webhook_signing or true)}",JSS_V04_COMPAT="${boolEnv (solidPodRsCfg.jss_v04_compat or true)}",AGENTBOX_REQUIRED_FOR_READINESS="true"
autostart=true