From 637b170cc5f85269f93bbe9bcd900eee4e54b2fc Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Tue, 2 Jun 2026 00:52:56 +0200
Subject: [PATCH] fix(#1052): use full nginx path in systemd-run reload (exit
 203 = EXEC)

---
 hive-c0re/src/gateway_nginx.rs | 16 +++++++++++-----
 nix/modules/hive-gateway.nix   |  3 ++-
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/hive-c0re/src/gateway_nginx.rs b/hive-c0re/src/gateway_nginx.rs
index 5dc4320f..a5bd79af 100644
--- a/hive-c0re/src/gateway_nginx.rs
+++ b/hive-c0re/src/gateway_nginx.rs
@@ -291,17 +291,23 @@ fn reload_gateway_nginx() {
     let success = match state.as_str() {
         "active" => {
             // nginx master is running — SIGHUP is the zero-downtime path.
-            // `systemd-run --machine=hive-gateway --quiet --wait -- nginx
-            // -s reload` runs the signal inside the container and exits
-            // with the nginx exit code. `--` separates systemd-run flags
-            // from the command.
+            // `systemd-run --machine=hive-gateway --quiet --wait --
+            // /run/current-system/sw/bin/nginx -s reload` runs the
+            // signal inside the container and exits with the nginx exit
+            // code. Full binary path required — systemd-run's limited
+            // PATH misses /run/current-system/sw/bin/. `--` separates
+            // systemd-run flags from the command.
             let status = std::process::Command::new("systemd-run")
                 .args([
                     "--machine=hive-gateway",
                     "--quiet",
                     "--wait",
                     "--",
-                    "nginx",
+                    // Full path required: systemd-run executes with a
+                    // limited PATH that doesn't include NixOS's
+                    // /run/current-system/sw/bin/ — plain "nginx" yields
+                    // exit 203 (EXEC failure).
+                    "/run/current-system/sw/bin/nginx",
                     "-s",
                     "reload",
                 ])
diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 851e8538..0f69b675 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -421,7 +421,8 @@ in
           };
 
           # nginx reload is triggered from the HOST side by hive-c0re
-          # via `systemd-run --machine=hive-gateway nginx -s reload`
+          # via `systemd-run --machine=hive-gateway /run/current-system/sw/bin/nginx -s reload`
+          # (full path required — systemd-run's limited PATH misses /run/current-system/sw/bin/)
           # after each agents.conf write. A path unit watching the
           # bind-mounted file inside the container was tried first
           # (A path unit inside the container was tried but IN_MOVED_TO from an atomic rename on the host