vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#1845): correct ProtectSystem=strict comment (nix called directly via NIX_REMOTE=daemon)

Browse source
This commit is contained in:
atlas 2026-07-04 13:23:56 +02:00 • committed by mara
commit 467d3fa82e
1 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/modules/hive-c0re.nix
View file

@ -1106,13 +1106,16 @@ in
ProtectHome = true; # HOME = /var/lib/hyperhive; no /home/* access needed ProtectHome = true; # HOME = /var/lib/hyperhive; no /home/* access needed
# "strict" makes the entire filesystem read-only except for # "strict" makes the entire filesystem read-only except for
# StateDirectory (/var/lib/hyperhive) and RuntimeDirectory # StateDirectory (/var/lib/hyperhive) and RuntimeDirectory
# (/run/hyperhive), which systemd keeps writable. hive-c0re # (/run/hyperhive), which systemd keeps writable. No
# never writes to /usr, /etc, /boot, /run (other than its own # ReadWritePaths needed beyond the managed directories because:
# RuntimeDirectory), or /nix — all /etc writes go through # - nix is invoked directly (lifecycle, meta, flake_check), but
# hive-priv, /etc/hyperhive/serve.json is read-only at startup, # NIX_REMOTE=daemon routes all store writes through the host
# and the service never calls nix directly (builds delegate to # daemon — hive-c0re never writes to /nix itself.
# hive-priv via the privileged socket). No ReadWritePaths needed # - flake.lock ops land in the meta worktree under StateDirectory
# beyond the managed directories. # (kept writable by systemd).
# - nix build worktrees live in PrivateTmp, not /tmp.
# - /etc writes (bind-mount edits) go through hive-priv via the
# privileged socket; /etc/hyperhive/serve.json is read-only.
ProtectSystem = "strict"; ProtectSystem = "strict";
ProtectKernelTunables = true; # no sysctl writes ProtectKernelTunables = true; # no sysctl writes
ProtectKernelLogs = true; # reads logs via systemd-journal group, not /dev/kmsg ProtectKernelLogs = true; # reads logs via systemd-journal group, not /dev/kmsg