mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

tmpfiles creates the agents root owned by hive-core

Browse source 
a fresh host's hive-priv made /var/lib/hyperhive/agents root-owned, so
hive-c0re could not create agent dirs (nightly run #7113). the rule
names no mode, so existing hosts are unchanged.

Closes #6143
This commit is contained in:
atlas 2026-11-06 20:30:17 +01:00
commit f1f611ba01
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/hive-c0re/default.nix
View file

@ -208,6 +208,12 @@ in
});
'';
# The parent of every agent's state dir. hive-c0re runs as hive-core and
# makes `agents/<name>/...` itself, so the root must be hive-core's before
# the first agent exists; hive-priv would otherwise create it root-owned.
# No mode: tmpfiles creates it 0755 and leaves an existing dir's mode alone.
systemd.tmpfiles.rules = [ "d /var/lib/hyperhive/agents - hive-core hive-core -" ];
# The gateway nginx is always the sole external entry point (it runs
# alongside hyperhive), so the per-agent web-port range stays closed on
# the host firewall. See `docs/4-implementation/networking/gateway.md::Firewall posture (host-level)`.