vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#2573): add /run/hive-ci to hive-priv ReadWritePaths so the ci-runner token write doesn't EROFS

Browse source
This commit is contained in:
damocles 2026-07-18 16:31:18 +02:00
commit 6407510744
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/hive-priv.nix
View file

@ -120,6 +120,13 @@ in
# first `nixos-container create` (ruth, on a
# fresh host) dies with "Read-only file
# system" before any container exists.
# /run/hive-ci — hive-c0re delegates the forge CI-runner
# registration-token write to hive-priv
# (`register_ci_runner` → /run/hive-ci/runner-token).
# Without this carve-out the write EROFSes under
# ProtectSystem=strict, the token stays the tmpfiles
# `TOKEN=placeholder` seed, and gitea-runner
# crash-loops → no CI runs hive-wide.
# /var/lib/nixos-containers — container rootfs written by nixos-container
# /var/lib/hyperhive — agent state files written by WriteAgentForgeToken
# / WriteAgentMatrixToken (tokens under agents/<n>/state/)
@ -131,6 +138,7 @@ in
"/run/hive-agent"
"/run/systemd"
"/run/lock"
"/run/hive-ci"
"/var/lib/nixos-containers"
"/var/lib/hyperhive"
"/nix"