vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#924): set web socket mode to 0o666 so gateway nginx can connect

Browse source
This commit is contained in:
damocles 2026-06-01 15:52:28 +02:00 • committed by mara
commit 8e2f311e09
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hive-ag3nt/src/web_ui.rs
View file

@ -164,9 +164,11 @@ pub async fn serve(
/// Best-effort unlinks any stale socket left from a crashed previous
/// harness (clean exit removes it, but `bind(2)` refuses to overwrite
/// an existing file) and `mkdir -p`s the parent for first-boot. Mode
/// `0o660` so a peer container bind-mounting the dir with a shared
/// group can `connect(2)`; the bind-mount source dir's ownership +
/// ACL is the real access gate.
/// `0o666` — world-accessible so the gateway container's nginx process
/// can `connect(2)` without sharing a group with the agent user.
/// The per-agent subdir (`/run/hive-agent/<name>/`) is only accessible
/// to containers that have it bind-mounted, so world-accessible sockets
/// are not a material risk.
///
/// Marker-gating + the gateway-side consumer: see
/// [`docs/gateway.md::Per-agent unix-socket upstream`](../../../docs/gateway.md).
@ -182,7 +184,7 @@ fn bind_unix(path: &Path) -> Result<tokio::net::UnixListener> {
let listener = tokio::net::UnixListener::bind(path)
.with_context(|| format!("bind unix socket at {}", path.display()))?;
use std::os::unix::fs::PermissionsExt;
std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o660))
std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o666))
.with_context(|| format!("set perms on {}", path.display()))?;
// Best-effort ready marker: failed write isn't fatal (the harness
// still binds + serves), it just means the gateway side keeps the