From 467d3fa82eef9f67b0e2905abe14d50e7d925d59 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 4 Jul 2026 13:23:56 +0200 Subject: [PATCH] fix(#1845): correct ProtectSystem=strict comment (nix called directly via NIX_REMOTE=daemon) --- nix/modules/hive-c0re.nix | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix index 5adf840d..ea719720 100644 --- a/nix/modules/hive-c0re.nix +++ b/nix/modules/hive-c0re.nix @@ -1106,13 +1106,16 @@ in ProtectHome = true; # HOME = /var/lib/hyperhive; no /home/* access needed # "strict" makes the entire filesystem read-only except for # StateDirectory (/var/lib/hyperhive) and RuntimeDirectory - # (/run/hyperhive), which systemd keeps writable. hive-c0re - # never writes to /usr, /etc, /boot, /run (other than its own - # RuntimeDirectory), or /nix — all /etc writes go through - # hive-priv, /etc/hyperhive/serve.json is read-only at startup, - # and the service never calls nix directly (builds delegate to - # hive-priv via the privileged socket). No ReadWritePaths needed - # beyond the managed directories. + # (/run/hyperhive), which systemd keeps writable. No + # ReadWritePaths needed beyond the managed directories because: + # - nix is invoked directly (lifecycle, meta, flake_check), but + # NIX_REMOTE=daemon routes all store writes through the host + # daemon — hive-c0re never writes to /nix itself. + # - flake.lock ops land in the meta worktree under StateDirectory + # (kept writable by systemd). + # - nix build worktrees live in PrivateTmp, not /tmp. + # - /etc writes (bind-mount edits) go through hive-priv via the + # privileged socket; /etc/hyperhive/serve.json is read-only. ProtectSystem = "strict"; ProtectKernelTunables = true; # no sysctl writes ProtectKernelLogs = true; # reads logs via systemd-journal group, not /dev/kmsg