vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#1052): use full nginx path in systemd-run reload (exit 203 = EXEC)

Browse source
This commit is contained in:
damocles 2026-06-02 00:52:56 +02:00
commit 637b170cc5
2 changed files with 13 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
hive-c0re/src/gateway_nginx.rs
View file

@ -291,17 +291,23 @@ fn reload_gateway_nginx() {
let success = match state.as_str() {
"active" => {
// nginx master is running — SIGHUP is the zero-downtime path.
// `systemd-run --machine=hive-gateway --quiet --wait -- nginx
// -s reload` runs the signal inside the container and exits
// with the nginx exit code. `--` separates systemd-run flags
// from the command.
// `systemd-run --machine=hive-gateway --quiet --wait --
// /run/current-system/sw/bin/nginx -s reload` runs the
// signal inside the container and exits with the nginx exit
// code. Full binary path required — systemd-run's limited
// PATH misses /run/current-system/sw/bin/. `--` separates
// systemd-run flags from the command.
let status = std::process::Command::new("systemd-run")
.args([
"--machine=hive-gateway",
"--quiet",
"--wait",
"--",
"nginx",
// Full path required: systemd-run executes with a
// limited PATH that doesn't include NixOS's
// /run/current-system/sw/bin/ — plain "nginx" yields
// exit 203 (EXEC failure).
"/run/current-system/sw/bin/nginx",
"-s",
"reload",
])

3
nix/modules/hive-gateway.nix
View file

@ -421,7 +421,8 @@ in
};
# nginx reload is triggered from the HOST side by hive-c0re
# via `systemd-run --machine=hive-gateway nginx -s reload`
# via `systemd-run --machine=hive-gateway /run/current-system/sw/bin/nginx -s reload`
# (full path required — systemd-run's limited PATH misses /run/current-system/sw/bin/)
# after each agents.conf write. A path unit watching the
# bind-mounted file inside the container was tried first
# (A path unit inside the container was tried but IN_MOVED_TO from an atomic rename on the host