From a35b67b7c5789288f9b029f1219a6334a2adb71e Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Sat, 18 Jul 2026 16:38:06 +0200
Subject: [PATCH] fix(#2573): also add /etc/tmpfiles.d to hive-priv
 ReadWritePaths (same EROFS class)

---
 nix/host-modules/hive-priv.nix | 43 ++++++++++++----------------------
 1 file changed, 15 insertions(+), 28 deletions(-)

diff --git a/nix/host-modules/hive-priv.nix b/nix/host-modules/hive-priv.nix
index 85eea6af..fdf5fc74 100644
--- a/nix/host-modules/hive-priv.nix
+++ b/nix/host-modules/hive-priv.nix
@@ -104,37 +104,24 @@ in
         PrivateTmp = true;
         ProtectHome = true;
         # Harden the file system view: strict makes the entire hierarchy
-        # read-only by default; ReadWritePaths carves out exactly the
-        # paths hive-priv must write to at runtime.
-        #
-        # Why each entry is needed:
-        #   /etc/nixos-containers  — writes <container>.conf (bind mounts,
-        #                            network isolation, nspawn flags)
-        #   /run/hive-agent        — chown/chmod per-agent socket directories
-        #   /run/systemd           — container@ unit drop-ins (resource limits)
-        #                            + machinectl / systemd-machined state
-        #   /run/lock              — `nixos-container` opens a lock file at
-        #                            /run/lock/nixos-container to serialise
-        #                            create/destroy. Under ProtectSystem=strict
-        #                            /run is read-only, so without this the very
-        #                            first `nixos-container create` (ruth, on a
-        #                            fresh host) dies with "Read-only file
-        #                            system" before any container exists.
-        #   /run/hive-ci           — hive-c0re delegates the forge CI-runner
-        #                            registration-token write to hive-priv
-        #                            (`register_ci_runner` → /run/hive-ci/runner-token).
-        #                            Without this carve-out the write EROFSes under
-        #                            ProtectSystem=strict, the token stays the tmpfiles
-        #                            `TOKEN=placeholder` seed, and gitea-runner
-        #                            crash-loops → no CI runs hive-wide.
-        #   /var/lib/nixos-containers — container rootfs written by nixos-container
-        #   /var/lib/hyperhive     — agent state files written by WriteAgentForgeToken
-        #                            / WriteAgentMatrixToken (tokens under agents/<n>/state/)
-        #   /nix                   — nix store + profile updates during
-        #                            container create/update
+        # read-only by default; ReadWritePaths carves out exactly the paths
+        # hive-priv must write to at runtime. Each is a confirmed hive-priv
+        # write that EROFSes (os error 30) without its carve-out:
+        #   /etc/nixos-containers     — <container>.conf (bind mounts, nspawn flags)
+        #   /etc/tmpfiles.d           — sync_tmpfiles' hyperhive-agents.conf write
+        #   /run/hive-agent           — chown/chmod per-agent socket dirs
+        #   /run/systemd              — container@ drop-ins + machined state
+        #   /run/lock                 — nixos-container's create/destroy lock file
+        #   /run/hive-ci              — register_ci_runner's runner-token write
+        #                               (else token stays placeholder → runner
+        #                               crash-loops → no CI hive-wide)
+        #   /var/lib/nixos-containers — container rootfs
+        #   /var/lib/hyperhive        — agent state (forge/matrix token files)
+        #   /nix                      — nix store + profile updates on create/update
         ProtectSystem = "strict";
         ReadWritePaths = [
           "/etc/nixos-containers"
+          "/etc/tmpfiles.d"
           "/run/hive-agent"
           "/run/systemd"
           "/run/lock"