vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: address argus review nits — tmpfiles dir comment, drop redundant chmod

Browse source
This commit is contained in:
atlas 2026-06-01 00:18:19 +02:00
commit 2fd6de7bab
1 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/modules/hive-ci.nix
View file

@ -47,9 +47,9 @@ let
exit 1 exit 1
fi fi
# Write in EnvironmentFile format: TOKEN=<value> # Write in EnvironmentFile format: TOKEN=<value>.
# File is already 0600 (set by tmpfiles on boot).
echo "TOKEN=$REG_TOKEN" > "$TOKEN_FILE" echo "TOKEN=$REG_TOKEN" > "$TOKEN_FILE"
chmod 600 "$TOKEN_FILE"
''; '';
in in
{ {
@ -201,6 +201,12 @@ in
# overwrites this placeholder with the real token before the runner # overwrites this placeholder with the real token before the runner
# starts. On subsequent boots the placeholder is harmless because # starts. On subsequent boots the placeholder is harmless because
# the nixpkgs register step exits early when .runner already exists. # the nixpkgs register step exits early when .runner already exists.
#
# Note: `f` doesn't create parent directories, but /run/hive-ci/
# is guaranteed to exist by the time container systemd starts:
# nspawn creates mount-point directories for all bindMounts before
# launching the container's init. So the dir is there when
# systemd-tmpfiles-setup.service runs.
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"f /run/hive-ci/runner-token 0600 root root - TOKEN=placeholder" "f /run/hive-ci/runner-token 0600 root root - TOKEN=placeholder"
]; ];