vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(#1159): set WorkingDirectory=/var/lib/hive-priv for hive-priv service

Browse source 
With ProtectSystem=strict (added in the previous commit), / is read-only
inside hive-priv. nix creates a temp result symlink in its cwd; without
WorkingDirectory that cwd is / (systemd default), causing:

  error: creating symlink /.tmp.tmp-...: Read-only file system

Point WorkingDirectory at the StateDirectory (/var/lib/hive-priv) which is
always writable under strict. Nix drops its temp symlink there instead.
This commit is contained in:
damocles 2026-06-03 17:44:37 +02:00
commit 9aa624d310
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/modules/hive-c0re.nix
View file

@ -771,6 +771,15 @@ in
]; ];
# Writable HOME for nix's caches (see environment.HOME above). # Writable HOME for nix's caches (see environment.HOME above).
StateDirectory = "hive-priv"; StateDirectory = "hive-priv";
# With ProtectSystem=strict the root filesystem is read-only inside
# hive-priv. When `nixos-container create/update` invokes nix, nix
# creates a temporary result symlink in its working directory. Without
# an explicit WorkingDirectory the cwd is / (inherited from systemd),
# which is read-only under strict, causing:
# error: creating symlink "/.tmp.tmp-..." -> ...: Read-only file system
# Point the working directory at the writable StateDirectory so nix
# drops its temp symlink there instead.
WorkingDirectory = "/var/lib/hive-priv";
# nix (run here as root for `nixos-container update --flake # nix (run here as root for `nixos-container update --flake
# /var/lib/hyperhive/meta#<agent>`) fetches the hive-core-owned # /var/lib/hyperhive/meta#<agent>`) fetches the hive-core-owned
# meta/applied repos; libgit2 refuses them without safe.directory. # meta/applied repos; libgit2 refuses them without safe.directory.