vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(systemd): set explicit SyslogIdentifier on hyperhive-declared units

Browse source 
Follow-up to the harness fix: any unit whose ExecStart is a generated
wrapper (a NixOS `script =` block or a writeShellScript) gets its journal
SyslogIdentifier derived from the wrapper's store-path basename — an
opaque, unstable name. Pin an explicit stable identifier on every unit
hyperhive declares.

script/wrapper units (leaked store paths): forgejo-gpg-init,
hive-gateway-self-signed-cert, hive-tls-ca, hive-ci-prefetch,
hyperhive-isolated-dns, tea-login, forge-avatar-sync,
matrix-avatar-sync, hive-dashboard-links.

direct-binary units (basename already sane; explicit for tidiness +
future-proofing): hive-c0re, hive-priv, hive-matrix-daemon,
hive-bash-daemon, weston.

Only changes the displayed line identifier; journalctl -u <unit>
filtering (keys on _SYSTEMD_UNIT) is unaffected.
This commit is contained in:
atlas 2026-06-23 22:49:34 +02:00 • committed by mara
commit 14ae7367cd
7 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/modules/hive-c0re.nix
View file

@ -973,6 +973,7 @@ in
};
serviceConfig = {
ExecStart = "${cfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --config ${serveConfig}";
SyslogIdentifier = "hive-c0re";
# Migrate hive-c0re's *own* state to the service user after an
# upgrade from a root-run install (systemd's StateDirectory only
# chowns the top-level dir, not pre-existing files inside it). The
@ -1109,6 +1110,7 @@ in
};
serviceConfig = {
ExecStart = "${cfg.package}/bin/hive-priv";
SyslogIdentifier = "hive-priv";
Type = "simple";
User = "root";
PrivateTmp = true;

3
nix/modules/hive-ci.nix
View file

@ -319,6 +319,9 @@ in
Type = "oneshot";
RemainAfterExit = true;
ExecStart = prefetchScript;
# Pin the journal identity; ExecStart is a writeShellScript whose
# store-path basename would otherwise be the journal identifier.
SyslogIdentifier = "hive-ci-prefetch";
};
};

2
nix/modules/hive-forge.nix
View file

@ -364,6 +364,8 @@ in
Type = "oneshot";
User = "forgejo";
Group = "forgejo";
# Pin the journal identity (else it's the `script` store-path wrapper).
SyslogIdentifier = "forgejo-gpg-init";
};
# GNUPGHOME = the keyring forgejo signs from; HOME so
# `git config --global` lands where the forgejo process reads it.

2
nix/modules/hive-gateway.nix
View file

@ -830,6 +830,8 @@ in
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
# Pin the journal identity (else it's the `script` store-path wrapper).
SyslogIdentifier = "hive-gateway-self-signed-cert";
};
path = [ pkgs.coreutils ];
script = ''

2
nix/modules/hive-tls.nix
View file

@ -100,6 +100,8 @@ in
Type = "oneshot";
RemainAfterExit = true;
UMask = "0077";
# Pin the journal identity (else it's the `script` store-path wrapper).
SyslogIdentifier = "hive-tls-ca";
};
script = ''
set -euo pipefail