vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#2573): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)

Browse source
This commit is contained in:
damocles 2026-07-18 16:38:06 +02:00
commit a35b67b7c5
1 changed files with 15 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

43
nix/host-modules/hive-priv.nix
View file

@ -104,37 +104,24 @@ in
PrivateTmp = true;
ProtectHome = true;
# Harden the file system view: strict makes the entire hierarchy
# read-only by default; ReadWritePaths carves out exactly the
# paths hive-priv must write to at runtime.
#
# Why each entry is needed:
# /etc/nixos-containers — writes <container>.conf (bind mounts,
# network isolation, nspawn flags)
# /run/hive-agent — chown/chmod per-agent socket directories
# /run/systemd — container@ unit drop-ins (resource limits)
# + machinectl / systemd-machined state
# /run/lock — `nixos-container` opens a lock file at
# /run/lock/nixos-container to serialise
# create/destroy. Under ProtectSystem=strict
# /run is read-only, so without this the very
# first `nixos-container create` (ruth, on a
# fresh host) dies with "Read-only file
# system" before any container exists.
# /run/hive-ci — hive-c0re delegates the forge CI-runner
# registration-token write to hive-priv
# (`register_ci_runner` → /run/hive-ci/runner-token).
# Without this carve-out the write EROFSes under
# ProtectSystem=strict, the token stays the tmpfiles
# `TOKEN=placeholder` seed, and gitea-runner
# crash-loops → no CI runs hive-wide.
# /var/lib/nixos-containers — container rootfs written by nixos-container
# /var/lib/hyperhive — agent state files written by WriteAgentForgeToken
# / WriteAgentMatrixToken (tokens under agents/<n>/state/)
# /nix — nix store + profile updates during
# container create/update
# read-only by default; ReadWritePaths carves out exactly the paths
# hive-priv must write to at runtime. Each is a confirmed hive-priv
# write that EROFSes (os error 30) without its carve-out:
# /etc/nixos-containers — <container>.conf (bind mounts, nspawn flags)
# /etc/tmpfiles.d — sync_tmpfiles' hyperhive-agents.conf write
# /run/hive-agent — chown/chmod per-agent socket dirs
# /run/systemd — container@ drop-ins + machined state
# /run/lock — nixos-container's create/destroy lock file
# /run/hive-ci — register_ci_runner's runner-token write
# (else token stays placeholder → runner
# crash-loops → no CI hive-wide)
# /var/lib/nixos-containers — container rootfs
# /var/lib/hyperhive — agent state (forge/matrix token files)
# /nix — nix store + profile updates on create/update
ProtectSystem = "strict";
ReadWritePaths = [
"/etc/nixos-containers"
"/etc/tmpfiles.d"
"/run/hive-agent"
"/run/systemd"
"/run/lock"