vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: re-run hive-ci-prefetch on every container restart via partOf

Browse source 
The hive-ci-prefetch oneshot has RemainAfterExit=true and is wired to the
container only via wantedBy + before. Once it runs successfully it stays
'active (exited)' indefinitely, so systemd skips it on subsequent container
restarts. The runner-token file it wrote is never refreshed.

This breaks the runner after its first registration: the token written on
the first successful boot is either a placeholder (forge-core-token wasn't
ready yet) or a registration token that has since been consumed/rotated.
On the next container restart prefetch does not re-run, the stale token
persists, and the in-container register service fails with
'invalid_argument: runner registration token not found' — exactly the
symptom in the field (worked briefly, two orphan runners registered, then
permanently offline).

Add partOf = [ nixos-container@hive-ci.service ] so a container stop/restart
propagates to the prefetch unit, forcing it to re-run and fetch a fresh
registration token before the container comes back up. before= still orders
it ahead of the container start within the same transaction.
This commit is contained in:
atlas 2026-06-04 21:16:44 +02:00 • committed by mara
commit 4f446269ae
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/modules/hive-ci.nix
View file

@ -248,6 +248,17 @@ in
];
before = [ "nixos-container@hive-ci.service" ];
wantedBy = [ "nixos-container@hive-ci.service" ];
# partOf binds this oneshot's lifecycle to the container: when the
# container is stopped or restarted, systemd propagates that to this
# unit so it re-runs on the NEXT container start. Without this, the
# RemainAfterExit=true oneshot stays "active (exited)" forever after
# its first run — so a container restart skips it and the stale
# runner-token file (a placeholder from a boot where the forge token
# wasn't ready yet, or a registration token consumed/rotated since)
# is never refreshed. The in-container register service then fails
# with "runner registration token not found". partOf guarantees a
# fresh token is fetched before every container (re)start.
partOf = [ "nixos-container@hive-ci.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;