vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-ci-runner: keep the registration token on the host's /run, not in the container's root

Browse source 
swarm-bao-ci-runner still reads the token from bao under the runner's own
ci-runner leaf, but now writes it to /run/swarm-ci-runner on the host
(tmpfs), which the container bind-mounts read-only for the register
unit's LoadCredential. Before, it wrote the token to
/var/lib/nixos-containers/swarm-ci-runner/var/lib/swarm-ci-runner/registration-token
on persistent disk, where a superseded token stayed after rotation and
went into backups of the container root. The container's tmpfiles now
remove that old file.

Rotation is unchanged: the ten-minute timer rewrites the file when the
value differs and refresh_consumer restarts the runner. After a reboot
the token is fetched again; until the store answers, a runner that is
already registered keeps running and only a new registration waits.

Part of #4998 (slice 1).
This commit is contained in:
atlas 2026-10-15 20:30:05 +02:00 • committed by mara
commit 23807c5d0c
4 changed files with 54 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/module-eval/forge-placement.nix
View file

@ -233,7 +233,7 @@ let
let
sc = registerService.serviceConfig;
in
sc.LoadCredential == [ "registration-token:/var/lib/swarm-ci-runner/registration-token" ]
sc.LoadCredential == [ "registration-token:/run/swarm-ci-runner/registration-token" ]
&& sc.Type == "oneshot"
&& sc.User == runnerService.serviceConfig.User
&& sc.DynamicUser
@ -245,6 +245,24 @@ let
s: lib.hasInfix "gitea-register-runner" (toString s)
) runnerService.serviceConfig.ExecStartPre);
}
{
# A copy on persistent disk outlives the token's rotation and lands in
# backups of the container's root.
name = "the CI runner's registration token is written to the host's /run only, and the old copy removed";
ok =
let
script = ciAlone.systemd.services.swarm-bao-ci-runner.script;
mount = ciAlone.containers.swarm-ci-runner.bindMounts."/run/swarm-ci-runner";
guestRules = ciAlone.containers.swarm-ci-runner.config.systemd.tmpfiles.rules;
in
lib.hasInfix "atomic_write_secret 0600 \"\" /run/swarm-ci-runner/registration-token" script
&& !(lib.hasInfix "/var/lib/nixos-containers" script)
&& mount.hostPath == "/run/swarm-ci-runner"
&& mount.isReadOnly
&& lib.elem "d /run/swarm-ci-runner 0700 root root -" ciAlone.systemd.tmpfiles.rules
&& lib.elem "r /var/lib/swarm-ci-runner/registration-token" guestRules
&& !(lib.any (lib.hasPrefix "f /var/lib/swarm-ci-runner/registration-token") guestRules);
}
{
name = "the CI register unit registers from its credential, and only without a .runner";
ok =