From 0a3a956d281a89edd9ae69e2160e2f536367eb29 Mon Sep 17 00:00:00 2001
From: atlas <atlas@pr1ma.darkest.space>
Date: Thu, 4 Jun 2026 15:35:46 +0200
Subject: [PATCH] fix: add /var/lib/hyperhive to hive-priv ReadWritePaths

WriteAgentForgeToken and WriteAgentMatrixToken write agent state files
under /var/lib/hyperhive/agents/<name>/state/. The hive-priv service
has ProtectSystem=strict which makes all of /var read-only by default,
but /var/lib/hyperhive was missing from ReadWritePaths, causing EROFS
on every token write.

Closes #1274.
---
 nix/modules/hive-c0re.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index 0a8ef205..2376bc35 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -796,6 +796,8 @@ in
         #   /run/systemd           — container@ unit drop-ins (resource limits)
         #                            + machinectl / systemd-machined state
         #   /var/lib/nixos-containers — container rootfs written by nixos-container
+        #   /var/lib/hyperhive     — agent state files written by WriteAgentForgeToken
+        #                            / WriteAgentMatrixToken (tokens under agents/<n>/state/)
         #   /nix                   — nix store + profile updates during
         #                            container create/update
         ProtectSystem = "strict";
@@ -805,6 +807,7 @@ in
           "/run/hive-agent"
           "/run/systemd"
           "/var/lib/nixos-containers"
+          "/var/lib/hyperhive"
           "/nix"
         ];
         # Writable HOME for nix's caches (see environment.HOME above).