vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(#2573): also add /etc/tmpfiles.d to hive-priv ReadWritePaths (same EROFS class)

Browse source
This commit is contained in:
damocles 2026-07-18 16:38:06 +02:00
commit a35b67b7c5
1 changed files with 15 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

43
nix/host-modules/hive-priv.nix
View file

@ -104,37 +104,24 @@ in
PrivateTmp = true; PrivateTmp = true;
ProtectHome = true; ProtectHome = true;
# Harden the file system view: strict makes the entire hierarchy # Harden the file system view: strict makes the entire hierarchy
# read-only by default; ReadWritePaths carves out exactly the # read-only by default; ReadWritePaths carves out exactly the paths
# paths hive-priv must write to at runtime. # hive-priv must write to at runtime. Each is a confirmed hive-priv
# # write that EROFSes (os error 30) without its carve-out:
# Why each entry is needed: # /etc/nixos-containers — <container>.conf (bind mounts, nspawn flags)
# /etc/nixos-containers — writes <container>.conf (bind mounts, # /etc/tmpfiles.d — sync_tmpfiles' hyperhive-agents.conf write
# network isolation, nspawn flags) # /run/hive-agent — chown/chmod per-agent socket dirs
# /run/hive-agent — chown/chmod per-agent socket directories # /run/systemd — container@ drop-ins + machined state
# /run/systemd — container@ unit drop-ins (resource limits) # /run/lock — nixos-container's create/destroy lock file
# + machinectl / systemd-machined state # /run/hive-ci — register_ci_runner's runner-token write
# /run/lock — `nixos-container` opens a lock file at # (else token stays placeholder → runner
# /run/lock/nixos-container to serialise # crash-loops → no CI hive-wide)
# create/destroy. Under ProtectSystem=strict # /var/lib/nixos-containers — container rootfs
# /run is read-only, so without this the very # /var/lib/hyperhive — agent state (forge/matrix token files)
# first `nixos-container create` (ruth, on a # /nix — nix store + profile updates on create/update
# fresh host) dies with "Read-only file
# system" before any container exists.
# /run/hive-ci — hive-c0re delegates the forge CI-runner
# registration-token write to hive-priv
# (`register_ci_runner` → /run/hive-ci/runner-token).
# Without this carve-out the write EROFSes under
# ProtectSystem=strict, the token stays the tmpfiles
# `TOKEN=placeholder` seed, and gitea-runner
# crash-loops → no CI runs hive-wide.
# /var/lib/nixos-containers — container rootfs written by nixos-container
# /var/lib/hyperhive — agent state files written by WriteAgentForgeToken
# / WriteAgentMatrixToken (tokens under agents/<n>/state/)
# /nix — nix store + profile updates during
# container create/update
ProtectSystem = "strict"; ProtectSystem = "strict";
ReadWritePaths = [ ReadWritePaths = [
"/etc/nixos-containers" "/etc/nixos-containers"
"/etc/tmpfiles.d"
"/run/hive-agent" "/run/hive-agent"
"/run/systemd" "/run/systemd"
"/run/lock" "/run/lock"