From 1e986a0270b32a7027518dcb69e3df09fa8b23e9 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 4 Jul 2026 21:04:18 +0200 Subject: [PATCH] chore(nix): remove stale 'privsep phase 2' labels from comments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit privsep is complete and always on. the phased-rollout framing is historical — drop it from the inline comments, keeping the accurate description of what the user + delegation actually do. --- nix/modules/hive-c0re.nix | 7 +++---- nix/modules/hive-gateway.nix | 2 +- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix index ea719720..451a5a46 100644 --- a/nix/modules/hive-c0re.nix +++ b/nix/modules/hive-c0re.nix @@ -795,10 +795,9 @@ in managerToplevel ]; - # Unprivileged coordinator user. hive-c0re runs as this user - # (privsep phase 2); privileged operations are delegated to - # hive-priv which runs as root, socket-activated at - # /run/hive/priv.sock. + # Unprivileged coordinator user. hive-c0re runs as this user; + # privileged operations are delegated to hive-priv which runs as + # root, socket-activated at /run/hive/priv.sock. users.users.hive-core = { isSystemUser = true; group = "hive-core"; diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index bdb37df7..c494b1ae 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -423,7 +423,7 @@ in # # /run/hive-agent — per-agent UDS socket dir, written by c0re's # set_nspawn_flags when agents start. Owned by `hive-core` (the - # unprivileged coordinator user, privsep phase 2): c0re does the + # unprivileged coordinator user): c0re does the # `create_dir_all(/run/hive-agent/)` itself, so a root-owned # parent would EACCES on the very first agent create on a fresh host # (hive-priv only chowns the subdir afterwards, it doesn't make it).