fix(#1012): add path trigger for forge-avatar-sync so it fires on token arrival

On first agent deployment, the container boots before hive-c0re has
provisioned the forge-token. forge-avatar-sync was exiting early with
"no forge-token found", and RemainAfterExit=true prevented systemd
from ever re-running it — avatar never got uploaded until the next
container reboot.

Add a systemd.paths.forge-avatar-sync unit (PathExistsGlob on the
forge-token file) to re-fire the service once the token arrives, and
set RemainAfterExit=false to allow the re-fire. Mirrors the existing
matrix-avatar-sync pattern exactly.
This commit is contained in:
atlas 2026-06-01 23:20:37 +02:00 committed by mara
commit 4f684dc7c3

View file

@ -1018,15 +1018,30 @@ in
'';
};
# Path-trigger sibling: re-fires forge-avatar-sync the moment
# `<state>/forge-token` appears. Mirrors the matrix-avatar-sync
# pattern — on first agent deployment the container boots before
# hive-c0re has provisioned the forge-token, so the service fires
# too early and exits with "no forge-token found". Without this path
# unit, RemainAfterExit=true would prevent systemd from ever
# re-running the service. See docs/persistence.md::forge-avatar-sync.
systemd.paths.forge-avatar-sync = {
description = "trigger forge-avatar-sync when forge-token appears";
wantedBy = [ "multi-user.target" ];
pathConfig.PathExistsGlob = "/agents/*/state/forge-token";
};
# One-shot: hyperhive.icon → Forgejo profile avatar. Shape contract:
# docs/conventions.md::Best-effort oneshot services.
# RemainAfterExit = false (unlike the old true) so the .path trigger
# above can re-fire this unit when the forge-token arrives after boot.
systemd.services.forge-avatar-sync = {
description = "sync agent icon to Forgejo user avatar (best-effort)";
wantedBy = [ "multi-user.target" ];
after = [ "tea-login.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
RemainAfterExit = false;
};
path = [
pkgs.curl
@ -1320,4 +1335,3 @@ in
system.stateVersion = "25.11";
};
}