vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: add /var/lib/hyperhive to hive-priv ReadWritePaths

Browse source 
WriteAgentForgeToken and WriteAgentMatrixToken write agent state files
under /var/lib/hyperhive/agents/<name>/state/. The hive-priv service
has ProtectSystem=strict which makes all of /var read-only by default,
but /var/lib/hyperhive was missing from ReadWritePaths, causing EROFS
on every token write.

Closes #1274.
This commit is contained in:
atlas 2026-06-04 15:35:46 +02:00
commit 0a3a956d28
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nix/modules/hive-c0re.nix
View file

@ -796,6 +796,8 @@ in
# /run/systemd — container@ unit drop-ins (resource limits)
# + machinectl / systemd-machined state
# /var/lib/nixos-containers — container rootfs written by nixos-container
# /var/lib/hyperhive — agent state files written by WriteAgentForgeToken
# / WriteAgentMatrixToken (tokens under agents/<n>/state/)
# /nix — nix store + profile updates during
# container create/update
ProtectSystem = "strict";
@ -805,6 +807,7 @@ in
"/run/hive-agent"
"/run/systemd"
"/var/lib/nixos-containers"
"/var/lib/hyperhive"
"/nix"
];
# Writable HOME for nix's caches (see environment.HOME above).