From 4f446269aec5e7e0af83f8c20c9177ac1da81061 Mon Sep 17 00:00:00 2001 From: atlas Date: Thu, 4 Jun 2026 21:16:44 +0200 Subject: [PATCH] fix: re-run hive-ci-prefetch on every container restart via partOf MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The hive-ci-prefetch oneshot has RemainAfterExit=true and is wired to the container only via wantedBy + before. Once it runs successfully it stays 'active (exited)' indefinitely, so systemd skips it on subsequent container restarts. The runner-token file it wrote is never refreshed. This breaks the runner after its first registration: the token written on the first successful boot is either a placeholder (forge-core-token wasn't ready yet) or a registration token that has since been consumed/rotated. On the next container restart prefetch does not re-run, the stale token persists, and the in-container register service fails with 'invalid_argument: runner registration token not found' — exactly the symptom in the field (worked briefly, two orphan runners registered, then permanently offline). Add partOf = [ nixos-container@hive-ci.service ] so a container stop/restart propagates to the prefetch unit, forcing it to re-run and fetch a fresh registration token before the container comes back up. before= still orders it ahead of the container start within the same transaction. --- nix/modules/hive-ci.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix index 0c589e0a..9a5b5c81 100644 --- a/nix/modules/hive-ci.nix +++ b/nix/modules/hive-ci.nix @@ -248,6 +248,17 @@ in ]; before = [ "nixos-container@hive-ci.service" ]; wantedBy = [ "nixos-container@hive-ci.service" ]; + # partOf binds this oneshot's lifecycle to the container: when the + # container is stopped or restarted, systemd propagates that to this + # unit so it re-runs on the NEXT container start. Without this, the + # RemainAfterExit=true oneshot stays "active (exited)" forever after + # its first run — so a container restart skips it and the stale + # runner-token file (a placeholder from a boot where the forge token + # wasn't ready yet, or a registration token consumed/rotated since) + # is never refreshed. The in-container register service then fails + # with "runner registration token not found". partOf guarantees a + # fresh token is fetched before every container (re)start. + partOf = [ "nixos-container@hive-ci.service" ]; serviceConfig = { Type = "oneshot"; RemainAfterExit = true;