From 9451c06e82b35b8d643dc7ad7f3efe5a94a9d88f Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 16 Aug 2026 21:45:33 +0200 Subject: [PATCH] fix: let the secret-delivery oneshots outlive their own bounded wait MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three host units poll up to 120s for a secret authelia mints on its first boot, and all three are `Type=oneshot` with no `TimeoutStartSec`. systemd's `DefaultTimeoutStartSec` is 90s, so it kills them at 90 — before the script reaches its own `exit 1` and names the file that never appeared. The wait itself is fine; what's lost is the diagnosis. On a fresh hive the operator gets a bare start-timeout instead of "authelia has not minted ", several layers from the container that was actually slow. Found while writing the same unit for Grafana, where the timeout is set — so this is the existing three catching up with it, not a new pattern. --- nix/host-modules/hive-forge/default.nix | 8 ++++++++ nix/host-modules/hive-matrix.nix | 7 +++++++ 2 files changed, 15 insertions(+) diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index b137b340..039aaf0a 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -1086,6 +1086,10 @@ in Type = "oneshot"; RemainAfterExit = true; SyslogIdentifier = "hive-forge-oidc-secret"; + # Longer than the 120s bounded wait below. `DefaultTimeoutStartSec` + # is 90s, so without this systemd kills the unit at 90 — before it + # can emit the message naming the file it was waiting for. + TimeoutStartSec = "180s"; }; path = [ pkgs.coreutils ]; script = '' @@ -1139,6 +1143,10 @@ in Type = "oneshot"; RemainAfterExit = true; SyslogIdentifier = "hive-forge-swarm-controller-token"; + # Longer than the 120s bounded wait below. `DefaultTimeoutStartSec` + # is 90s, so without this systemd kills the unit at 90 — before it + # can emit the message naming the file it was waiting for. + TimeoutStartSec = "180s"; }; path = [ pkgs.coreutils ]; script = '' diff --git a/nix/host-modules/hive-matrix.nix b/nix/host-modules/hive-matrix.nix index e6fbe717..c3d6034b 100644 --- a/nix/host-modules/hive-matrix.nix +++ b/nix/host-modules/hive-matrix.nix @@ -710,6 +710,13 @@ in Type = "oneshot"; RemainAfterExit = true; SyslogIdentifier = "hive-matrix-oidc-secret"; + # Longer than the 120s bounded wait below, and that is the whole + # point: `DefaultTimeoutStartSec` is 90s, so without this systemd + # kills the unit at 90 — before it can emit the message naming the + # file it was waiting for. The failure then reads as a timeout with + # no cause rather than "authelia has not minted ", which is + # the one line that makes a fresh-hive SSO stall diagnosable. + TimeoutStartSec = "180s"; }; path = [ pkgs.coreutils ]; script = ''