mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

tmpfiles creates the agents root owned by hive-core

Browse source 
a fresh host's hive-priv made /var/lib/hyperhive/agents root-owned, so
hive-c0re could not create agent dirs (nightly run #7113). the rule
names no mode, so existing hosts are unchanged.

Closes #6143
This commit is contained in:
atlas 2026-11-06 20:30:17 +01:00
commit f1f611ba01
2 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/hive-c0re/default.nix
View file

@ -208,6 +208,12 @@ in
});
'';
# The parent of every agent's state dir. hive-c0re runs as hive-core and
# makes `agents/<name>/...` itself, so the root must be hive-core's before
# the first agent exists; hive-priv would otherwise create it root-owned.
# No mode: tmpfiles creates it 0755 and leaves an existing dir's mode alone.
systemd.tmpfiles.rules = [ "d /var/lib/hyperhive/agents - hive-core hive-core -" ];
# The gateway nginx is always the sole external entry point (it runs
# alongside hyperhive), so the per-agent web-port range stays closed on
# the host firewall. See `docs/4-implementation/networking/gateway.md::Firewall posture (host-level)`.

10
nix/module-eval/core-toggle.nix
View file

@ -807,6 +807,16 @@ let
&& hive.extraConfig == gw.lib.securityHeaders
&& hive.locations ? "/";
}
{
# hive-priv creates the agents root as root on a host with no agents yet,
# and hive-c0re (hive-core) then cannot make `agents/<name>`. The rule
# names no mode, so a host that has the dir keeps its mode. The second
# arm needs the first: a host with the controller off has no such rule.
name = "the agents root is created hive-core-owned with the mode left to the default";
ok =
lib.elem "d /var/lib/hyperhive/agents - hive-core hive-core -" allLocal.systemd.tmpfiles.rules
&& !(lib.any (lib.hasInfix "/var/lib/hyperhive/agents") centralToggleOff.systemd.tmpfiles.rules);
}
{
# The file held bcrypt hashes at 0644; a host carrying one from before
# gets it deleted, and nothing names it for nginx.