vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nix(ci): pin the runner readiness gate to --store daemon

Browse source 
A bare `nix store ping` run as root with the daemon socket absent
resolves to a local store (root writes /nix/store directly) and pings
successfully, so the gate could false-pass at cold boot: nix-daemon.socket
carries ConditionPathIsReadWrite=/nix/var/nix/daemon-socket and is
condition-skipped until /nix/var goes read-write. systemd service units
don't source the profile that sets NIX_REMOTE=daemon, so auto-store
fallback to local is the real environment here.

Pin --store daemon so the readiness poll verifies the actual daemon
socket and the gate honours its wait-for-daemon contract instead of
passing against a local fallback while the daemon is still down.
This commit is contained in:
atlas 2026-06-18 10:46:26 +02:00 • committed by mara
commit 2efd95d0f5
1 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/modules/hive-ci.nix
View file

@ -480,8 +480,24 @@ in
# only bites in the post-restart cold window. Non-fatal shape:
# if it never comes up the unit fails cleanly (recoverable)
# rather than the runner claiming jobs into a dead daemon.
#
# `--store daemon` is load-bearing. A bare `nix store ping`
# uses the `auto` store, which — when run as root with the
# daemon socket absent — silently resolves to a LOCAL store
# (root can write /nix/store directly) and pings successfully.
# systemd service units don't source the profile that sets
# `NIX_REMOTE=daemon`, so this is the real environment here.
# At cold boot the daemon socket IS absent: nix-daemon.socket
# carries `ConditionPathIsReadWrite=/nix/var/nix/daemon-socket`
# and is condition-skipped until /nix/var goes read-write. So
# a bare ping would pass against the local store while the
# daemon is still down — defeating the gate's whole purpose
# (the runner would start and claim jobs the daemon can't yet
# service). Pinning `--store daemon` makes the poll verify the
# actual daemon socket, so the gate honours its contract and
# waits until the daemon — not a local fallback — answers.
for _ in $(seq 1 90); do
if ${pkgs.nix}/bin/nix store ping >/dev/null 2>&1; then
if ${pkgs.nix}/bin/nix store ping --store daemon >/dev/null 2>&1; then
exit 0
fi
sleep 2