From 52f589780f68a2702b4f0531ee5efca702dbfb98 Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 9 Oct 2026 10:34:33 +0200 Subject: [PATCH] agent: order bao/github/forge-accounts logins after the isolated-DNS rewrite --- nix/agent-modules/network.nix | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/nix/agent-modules/network.nix b/nix/agent-modules/network.nix index bf9f9d6a..e6ad054c 100644 --- a/nix/agent-modules/network.nix +++ b/nix/agent-modules/network.nix @@ -44,8 +44,9 @@ # bridge dnsmasq (gateway IP) is. hive-priv drops the marker # `/etc/hyperhive-bridge-dns` (containing the gateway IP) since # isolation is always on; the oneshot reads it and rewrites - # resolv.conf on every boot. Ordered before the first DNS consumer - # (the forge-token fetch) and the network targets so name resolution works for + # resolv.conf on every boot. Ordered before the first DNS consumers + # (the forge-token, bao-identity, github-token and forge-accounts + # oneshots) and the network targets so name resolution works for # the very first turn. systemd.services.hyperhive-isolated-dns = { description = "point resolv.conf at the hive bridge resolver (isolated containers)"; @@ -58,10 +59,15 @@ # edge the harness can start before we've fixed resolv.conf and the # first turn errors — self-heals next turn, but better not to flap). # `hive-matrix-daemon` likewise syncs over the network; the `before` - # is a harmless no-op when matrix is disabled (the unit is absent). + # is a harmless no-op when matrix is disabled (the unit is absent); + # so are the bao-identity / github-token / forge-accounts edges on + # agents that don't enable those oneshots. before = [ "network-online.target" "hive-agent-forge-token.service" + "hive-agent-bao-identity.service" + "hive-agent-github-token.service" + "hive-agent-forge-accounts.service" "hive-agent.service" "hive-matrix-daemon.service" ];