From 14ae7367cd26d99cf4852407ed8a31ebf3349fe2 Mon Sep 17 00:00:00 2001 From: atlas Date: Tue, 23 Jun 2026 22:49:34 +0200 Subject: [PATCH] fix(systemd): set explicit SyslogIdentifier on hyperhive-declared units MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to the harness fix: any unit whose ExecStart is a generated wrapper (a NixOS `script =` block or a writeShellScript) gets its journal SyslogIdentifier derived from the wrapper's store-path basename — an opaque, unstable name. Pin an explicit stable identifier on every unit hyperhive declares. script/wrapper units (leaked store paths): forgejo-gpg-init, hive-gateway-self-signed-cert, hive-tls-ca, hive-ci-prefetch, hyperhive-isolated-dns, tea-login, forge-avatar-sync, matrix-avatar-sync, hive-dashboard-links. direct-binary units (basename already sane; explicit for tidiness + future-proofing): hive-c0re, hive-priv, hive-matrix-daemon, hive-bash-daemon, weston. Only changes the displayed line identifier; journalctl -u filtering (keys on _SYSTEMD_UNIT) is unaffected. --- nix/modules/hive-c0re.nix | 2 ++ nix/modules/hive-ci.nix | 3 +++ nix/modules/hive-forge.nix | 2 ++ nix/modules/hive-gateway.nix | 2 ++ nix/modules/hive-tls.nix | 2 ++ nix/templates/harness-base.nix | 13 +++++++++++++ nix/templates/weston-vnc.nix | 4 ++++ 7 files changed, 28 insertions(+) diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix index 52fc2cd8..7f2f8fb7 100644 --- a/nix/modules/hive-c0re.nix +++ b/nix/modules/hive-c0re.nix @@ -973,6 +973,7 @@ in }; serviceConfig = { ExecStart = "${cfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --config ${serveConfig}"; + SyslogIdentifier = "hive-c0re"; # Migrate hive-c0re's *own* state to the service user after an # upgrade from a root-run install (systemd's StateDirectory only # chowns the top-level dir, not pre-existing files inside it). The @@ -1109,6 +1110,7 @@ in }; serviceConfig = { ExecStart = "${cfg.package}/bin/hive-priv"; + SyslogIdentifier = "hive-priv"; Type = "simple"; User = "root"; PrivateTmp = true; diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix index 47f45906..7d07ec06 100644 --- a/nix/modules/hive-ci.nix +++ b/nix/modules/hive-ci.nix @@ -319,6 +319,9 @@ in Type = "oneshot"; RemainAfterExit = true; ExecStart = prefetchScript; + # Pin the journal identity; ExecStart is a writeShellScript whose + # store-path basename would otherwise be the journal identifier. + SyslogIdentifier = "hive-ci-prefetch"; }; }; diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix index ae0bd45c..ca30c11f 100644 --- a/nix/modules/hive-forge.nix +++ b/nix/modules/hive-forge.nix @@ -364,6 +364,8 @@ in Type = "oneshot"; User = "forgejo"; Group = "forgejo"; + # Pin the journal identity (else it's the `script` store-path wrapper). + SyslogIdentifier = "forgejo-gpg-init"; }; # GNUPGHOME = the keyring forgejo signs from; HOME so # `git config --global` lands where the forgejo process reads it. diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index 67154a7e..bde98ac3 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -830,6 +830,8 @@ in serviceConfig = { Type = "oneshot"; RemainAfterExit = true; + # Pin the journal identity (else it's the `script` store-path wrapper). + SyslogIdentifier = "hive-gateway-self-signed-cert"; }; path = [ pkgs.coreutils ]; script = '' diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix index b55533d8..2f38bdd6 100644 --- a/nix/modules/hive-tls.nix +++ b/nix/modules/hive-tls.nix @@ -100,6 +100,8 @@ in Type = "oneshot"; RemainAfterExit = true; UMask = "0077"; + # Pin the journal identity (else it's the `script` store-path wrapper). + SyslogIdentifier = "hive-tls-ca"; }; script = '' set -euo pipefail diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix index 355b5f1f..d198a909 100644 --- a/nix/templates/harness-base.nix +++ b/nix/templates/harness-base.nix @@ -1270,6 +1270,9 @@ in serviceConfig = { Type = "oneshot"; RemainAfterExit = true; + # Pin the journal identity; without it systemd derives it from the + # generated `script` store-path wrapper (an opaque `-…-start`). + SyslogIdentifier = "hyperhive-isolated-dns"; }; path = [ pkgs.coreutils ]; script = '' @@ -1294,6 +1297,8 @@ in serviceConfig = { Type = "oneshot"; RemainAfterExit = true; + # Pin the journal identity (else it's the `script` store-path wrapper). + SyslogIdentifier = "tea-login"; }; path = [ pkgs.curl @@ -1371,6 +1376,8 @@ in serviceConfig = { Type = "oneshot"; RemainAfterExit = false; + # Pin the journal identity (else it's the `script` store-path wrapper). + SyslogIdentifier = "forge-avatar-sync"; }; path = [ pkgs.curl @@ -1469,6 +1476,7 @@ in }; serviceConfig = { ExecStart = "${pkgs.hyperhive}/bin/hive-matrix-daemon"; + SyslogIdentifier = "hive-matrix-daemon"; Restart = "on-failure"; RestartSec = 5; User = userName; @@ -1524,6 +1532,7 @@ in }; serviceConfig = { ExecStart = "${pkgs.hyperhive}/bin/hive-bash-daemon"; + SyslogIdentifier = "hive-bash-daemon"; Restart = "on-failure"; RestartSec = 3; User = userName; @@ -1577,6 +1586,8 @@ in # RemainAfterExit = false so the .path trigger can re-fire # the unit (see docs/persistence.md::matrix-avatar-sync). RemainAfterExit = false; + # Pin the journal identity (else it's the `script` store-path wrapper). + SyslogIdentifier = "matrix-avatar-sync"; }; path = [ pkgs.curl @@ -1679,6 +1690,8 @@ in serviceConfig = { Type = "oneshot"; RemainAfterExit = true; + # Pin the journal identity (else it's the `script` store-path wrapper). + SyslogIdentifier = "hive-dashboard-links"; }; environment.LINKS_JSON = builtins.toJSON config.hyperhive.dashboardLinks; script = '' diff --git a/nix/templates/weston-vnc.nix b/nix/templates/weston-vnc.nix index 1d9a7c57..bd68cdf6 100644 --- a/nix/templates/weston-vnc.nix +++ b/nix/templates/weston-vnc.nix @@ -136,6 +136,10 @@ in --socket=wayland-0 \ --disable-transport-layer-security ''; + # ExecStart is already a direct `weston` exec (basename is clean), but + # pin the identity explicitly so it can't drift if a wrapper is ever + # introduced (sweep per the systemd SyslogIdentifier convention). + SyslogIdentifier = "weston"; Restart = "on-failure"; RestartSec = "5s"; };