From 065933b83ebc1583179055215b2c5e4456745140 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 14 Oct 2026 16:57:45 +0200
Subject: [PATCH] swarm-logs-auth: PrivateTmp=disconnected, as DynamicUser
 implied

DynamicUser implies PrivateTmp=disconnected (systemd.exec(5)), a tmpfs
of the unit's own rather than a private directory reachable from the
host namespace. The explicit setting now matches what the unit ran
with before it moved to a static user.

Refs #5235
---
 nix/host-modules/swarm-victorialogs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix/host-modules/swarm-victorialogs.nix b/nix/host-modules/swarm-victorialogs.nix
index 608bd42c..15ecac06 100644
--- a/nix/host-modules/swarm-victorialogs.nix
+++ b/nix/host-modules/swarm-victorialogs.nix
@@ -414,7 +414,7 @@ in
         SyslogIdentifier = logsAuthUnit;
         ProtectSystem = "strict";
         ProtectHome = true;
-        PrivateTmp = true;
+        PrivateTmp = "disconnected";
         PrivateDevices = true;
         NoNewPrivileges = true;
         RestrictSUIDSGID = true;