vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

declare the root-check link on hosts without a controller too

Browse source
This commit is contained in:
atlas 2026-10-30 11:18:53 +01:00
commit 7eb9db47d6
2 changed files with 23 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/host-modules/hive-priv.nix
View file

@ -12,16 +12,23 @@ let
rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
in
{
# The platform containers run their warn-only root check by this path
# (`lib/container-rootfs-check.nix`), so their units carry no store path.
# Declared outside the controller toggle below: a host that runs platform
# containers but no hive carries the check too.
imports = [
{
systemd.tmpfiles.rules = [
"L+ ${rootfsCheck.hivePriv} - - - - ${controllerCfg.package}/bin/hive-priv"
];
}
];
config = lib.mkIf config.services.hyperhive.deploy.hive-controller.enable {
# The parent of every agent socket dir. hive-priv is its only writer
# (`EnsureAgentSocketDir`), and its unit lists it in `ReadWritePaths`,
# which fails the unit when the path is missing.
systemd.tmpfiles.rules = [
"d /run/hive-agent 0755 root root - -"
# The platform containers run their warn-only root check by this path
# (`lib/container-rootfs-check.nix`), so their units carry no store path.
"L+ ${rootfsCheck.hivePriv} - - - - ${controllerCfg.package}/bin/hive-priv"
];
systemd.tmpfiles.rules = [ "d /run/hive-agent 0755 root root - -" ];
# Socket unit for hive-priv — the narrow root helper that executes
# privileged operations on behalf of hive-c0re. Systemd creates and

11
nix/module-eval/swarm-services-switch.nix
View file

@ -616,7 +616,16 @@ let
&& (s.hive-c0re.wantedBy or [ ]) == [ ]
&& !(swarmServicesOnly.systemd.sockets ? hive-c0re)
&& !(swarmServicesOnly.systemd.sockets ? hive-priv)
&& !(s ? swarm-bao-queue-agent);
&& !(s ? swarm-bao-queue-agent)
# The root check the platform containers carry runs through a link
# this host still declares, since no controller module does. Presence
# control: the unit and the rule are both found.
&& lib.any (
r: lib.hasPrefix "L+ /run/hive-rootfs-check " r
) swarmServicesOnly.systemd.tmpfiles.rules
&& lib.any (
p: lib.hasPrefix "-/run/hive-rootfs-check check-rootfs --warn-only " (toString p)
) s."container@swarm-bao".serviceConfig.ExecStartPre;
}
{
# On a controller that runs none of them, so the link cannot come from