From 317d58040582930e7728b078907cc767d125e76f Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive>
Date: Thu, 21 May 2026 23:05:13 +0200
Subject: [PATCH] =?UTF-8?q?harness:=20fix=20tea-login=20using=20getent=20(?=
 =?UTF-8?q?not=20in=20PATH)=20=E2=80=94=20hardcode=20/root?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 nix/templates/harness-base.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 11731be..01ec86b 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -393,10 +393,10 @@
                 # tea reads config from ~/.config/tea/config.yml (for root: /root/.config/tea/config.yml).
                 # Write it directly so we control default:true and always
                 # refresh a rotated token — no 'tea login add' interactive dance.
-                # Use getent to resolve root's home dir rather than $HOME which
-                # is unset in systemd service context (causing writes to /.config/).
-                _HOME=$(getent passwd root | cut -d: -f6)
-                CONFIG="$_HOME/.config/tea/config.yml"
+                # $HOME is unset in systemd service context (causing writes to
+                # /.config/). Hardcode /root — always correct for NixOS containers
+                # where the harness runs as root.
+                CONFIG="/root/.config/tea/config.yml"
                 mkdir -p "$(dirname "$CONFIG")" || true
                 cat > "$CONFIG" << EOF
         logins: