vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(3191): let hive-c0re write the gateway conf dir under strict sandboxing

Browse source 
Moving agents.conf/gateway.htpasswd out of StateDirectory (0e1a975f)
left hive-c0re unable to write them at all: ProtectSystem=strict only
keeps StateDirectory and RuntimeDirectory writable, so every write to
/var/lib/hive-gateway/conf failed with EROFS. agents.conf never got
past the tmpfiles pre-seed, so nginx had no location block for any
agent.
This commit is contained in:
müde 2026-08-12 16:39:58 +02:00
commit 657dba762b
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nix/host-modules/hive-c0re/default.nix
View file

@ -265,9 +265,9 @@ in
PrivateTmp = true; # uses StateDirectory for tmpfiles, not /tmp
ProtectHome = true; # HOME = /var/lib/hyperhive; no /home/* access needed
# "strict" makes the entire filesystem read-only except for
# StateDirectory (/var/lib/hyperhive) and RuntimeDirectory
# (/run/hyperhive), which systemd keeps writable. No
# ReadWritePaths needed beyond the managed directories because:
# StateDirectory (/var/lib/hyperhive), RuntimeDirectory
# (/run/hyperhive), and ReadWritePaths below, which systemd keeps
# writable. Beyond the managed directories:
# - nix is invoked directly (lifecycle, meta, flake_check), but
# NIX_REMOTE=daemon routes all store writes through the host
# daemon — hive-c0re never writes to /nix itself.
@ -276,7 +276,13 @@ in
# - nix build worktrees live in PrivateTmp, not /tmp.
# - /etc writes (bind-mount edits) go through hive-priv via the
# privileged socket; /etc/hyperhive/serve.json is read-only.
# - the gateway's nginx include + htpasswd live under
# /var/lib/hive-gateway/conf, deliberately outside StateDirectory
# (see hive-c0re/src/paths.rs::GATEWAY_CONF_DIR) so nginx never
# needs access to the rest of c0re's state — that separation
# means c0re itself needs an explicit carve-out to write there.
ProtectSystem = "strict";
ReadWritePaths = [ "/var/lib/hive-gateway/conf" ];
ProtectKernelTunables = true; # no sysctl writes
ProtectKernelLogs = true; # reads logs via systemd-journal group, not /dev/kmsg
ProtectControlGroups = true; # cgroup writes go through hive-priv, not c0re directly