vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

declare the root-check link on hosts without a controller too

Browse source
This commit is contained in:
atlas 2026-10-30 11:18:53 +01:00
commit 7eb9db47d6
1 changed files with 23 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/host-modules/hive-priv.nix
View file

@ -12,16 +12,23 @@ let
rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
in
{
# The platform containers run their warn-only root check by this path
# (`lib/container-rootfs-check.nix`), so their units carry no store path.
# Declared outside the controller toggle below: a host that runs platform
# containers but no hive carries the check too.
imports = [
{
systemd.tmpfiles.rules = [
"L+ ${rootfsCheck.hivePriv} - - - - ${controllerCfg.package}/bin/hive-priv"
];
}
];
config = lib.mkIf config.services.hyperhive.deploy.hive-controller.enable {
# The parent of every agent socket dir. hive-priv is its only writer
# (`EnsureAgentSocketDir`), and its unit lists it in `ReadWritePaths`,
# which fails the unit when the path is missing.
systemd.tmpfiles.rules = [
"d /run/hive-agent 0755 root root - -"
# The platform containers run their warn-only root check by this path
# (`lib/container-rootfs-check.nix`), so their units carry no store path.
"L+ ${rootfsCheck.hivePriv} - - - - ${controllerCfg.package}/bin/hive-priv"
];
systemd.tmpfiles.rules = [ "d /run/hive-agent 0755 root root - -" ];
# Socket unit for hive-priv — the narrow root helper that executes
# privileged operations on behalf of hive-c0re. Systemd creates and