From 2eb46c562b3ddf9342b5c2459823e6fd36e8c8fe Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Sun, 1 Nov 2026 11:24:06 +0100
Subject: [PATCH] back off the matrix daemon's restarts so a homeserver outage
 can't flood the store with logins

---
 nix/agent-modules/matrix.nix     |  7 +++++++
 nix/module-eval/agent-matrix.nix | 10 ++++++++++
 2 files changed, 17 insertions(+)

diff --git a/nix/agent-modules/matrix.nix b/nix/agent-modules/matrix.nix
index d9fabf64..fd5da842 100644
--- a/nix/agent-modules/matrix.nix
+++ b/nix/agent-modules/matrix.nix
@@ -396,6 +396,13 @@ in
         # non-zero exit, which `on-failure` already restarts.
         Restart = "on-failure";
         RestartSec = 5;
+        # Each start logs in to the store before its first homeserver call, so
+        # a down homeserver must not restart it every `RestartSec`. systemd
+        # grows the delay exponentially from `RestartSec` to `RestartMaxDelaySec`
+        # over `RestartSteps` restarts and resets it after a successful run
+        # (systemd.service(5)).
+        RestartSteps = 6;
+        RestartMaxDelaySec = 300;
         # The daemon exits 75 (`ACCOUNTS_CHANGED_EXIT` in
         # hive-matrix-mcp/src/main.rs) when the store's linked accounts change:
         # a clean exit that must still restart it onto the new set.
diff --git a/nix/module-eval/agent-matrix.nix b/nix/module-eval/agent-matrix.nix
index ec673f92..5c114403 100644
--- a/nix/module-eval/agent-matrix.nix
+++ b/nix/module-eval/agent-matrix.nix
@@ -168,6 +168,16 @@ let
       ok =
         agentMatrixBao.systemd.timers.hive-matrix-daemon.timerConfig.OnUnitInactiveSec or null == "5min";
     }
+    {
+      # A homeserver outage fails every start, and each start logs in to the
+      # store: the restart delay must grow rather than stay at `RestartSec`.
+      name = "the matrix daemon backs off between restarts";
+      ok =
+        let
+          c = (daemon agentMatrixBao).serviceConfig;
+        in
+        c.RestartSteps or 0 > 0 && c.RestartMaxDelaySec or 0 > c.RestartSec;
+    }
     {
       # The absence arm for the four above: with no store, no identity, no
       # timer, and the file is the whole mechanism.