hive-matrix: reject an override of registrationTokenFile instead of desyncing hive-c0re

This commit is contained in:
damocles 2026-09-07 15:19:57 +02:00 committed by mara
commit 9d55cba786
3 changed files with 76 additions and 3 deletions

View file

@ -255,6 +255,9 @@ pub const FORGE_CORE_TOKEN: &str = "/var/lib/hyperhive/forge-core-token";
/// `matrix-register-token` — shared matrix registration token.
// nix: bind-mounted into the tuwunel/matrix container (hive-matrix.nix) — must match.
// Not operator-option-driven: `registrationTokenFile` is `internal` on the nix
// side, and an `assertions` entry there rejects any attempt to move it, so this
// literal can never diverge from it.
#[must_use]
pub fn matrix_register_token() -> PathBuf {
state_root().join("matrix-register-token")