From 2fd6de7bab77d45040bb3f58b4995ea6af3e5403 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive>
Date: Mon, 1 Jun 2026 00:18:19 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20address=20argus=20review=20nits=20?=
 =?UTF-8?q?=E2=80=94=20tmpfiles=20dir=20comment,=20drop=20redundant=20chmo?=
 =?UTF-8?q?d?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 nix/modules/hive-ci.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index d0d60eba..af1ed595 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -47,9 +47,9 @@ let
       exit 1
     fi
 
-    # Write in EnvironmentFile format: TOKEN=<value>
+    # Write in EnvironmentFile format: TOKEN=<value>.
+    # File is already 0600 (set by tmpfiles on boot).
     echo "TOKEN=$REG_TOKEN" > "$TOKEN_FILE"
-    chmod 600 "$TOKEN_FILE"
   '';
 in
 {
@@ -201,6 +201,12 @@ in
           # overwrites this placeholder with the real token before the runner
           # starts. On subsequent boots the placeholder is harmless because
           # the nixpkgs register step exits early when .runner already exists.
+          #
+          # Note: `f` doesn't create parent directories, but /run/hive-ci/
+          # is guaranteed to exist by the time container systemd starts:
+          # nspawn creates mount-point directories for all bindMounts before
+          # launching the container's init. So the dir is there when
+          # systemd-tmpfiles-setup.service runs.
           systemd.tmpfiles.rules = [
             "f /run/hive-ci/runner-token 0600 root root - TOKEN=placeholder"
           ];