From a6147dc875cc531346e11139538b9e840a6137da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Sun, 18 Oct 2026 15:32:35 +0200
Subject: [PATCH] swarm-controller: chgrp the runtime dir in ExecStartPost,
 ExecStart's setup undid the ExecStartPre one

---
 nix/host-modules/swarm-controller.nix | 11 ++++++-----
 nix/module-eval/core-toggle.nix       |  4 ++--
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix
index 28a8cf83..55f14983 100644
--- a/nix/host-modules/swarm-controller.nix
+++ b/nix/host-modules/swarm-controller.nix
@@ -727,11 +727,12 @@ in
         # 0750 with the group set to `clientsGroup` below: only nginx and
         # root can reach the socket inside.
         RuntimeDirectoryMode = "0750";
-        # systemd chowns the runtime directory to `User:Group` on every
-        # start, and the daemon is not a member of `clientsGroup`, so it
-        # cannot chgrp the directory itself. `+` runs this as root, after
-        # that chown.
-        ExecStartPre = "+${pkgs.coreutils}/bin/chgrp ${clientsGroup} ${builtins.dirOf deployCfg.swarm-controller.socketPath}";
+        # systemd re-chowns the runtime directory to `User:Group` while
+        # setting up every command, `ExecStart` included, so a chgrp in
+        # `ExecStartPre` is undone. The daemon is not a member of
+        # `clientsGroup` and cannot chgrp it itself; `+` runs this as root,
+        # after the last chown.
+        ExecStartPost = "+${pkgs.coreutils}/bin/chgrp ${clientsGroup} ${builtins.dirOf deployCfg.swarm-controller.socketPath}";
         # Preserved across restarts so the path never vanishes from under a
         # running nginx. The daemon unlinks a stale socket on start, which
         # is what makes preservation safe.
diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix
index fe53eb4a..c7d6ba08 100644
--- a/nix/module-eval/core-toggle.nix
+++ b/nix/module-eval/core-toggle.nix
@@ -449,8 +449,8 @@ let
           group = "swarm-controller-clients";
         in
         sc.RuntimeDirectoryMode == "0750"
-        && lib.hasPrefix "+" sc.ExecStartPre
-        && lib.hasInfix "chgrp ${group} /run/swarm-controller" sc.ExecStartPre
+        && lib.hasPrefix "+" sc.ExecStartPost
+        && lib.hasInfix "chgrp ${group} /run/swarm-controller" sc.ExecStartPost
         && lib.elem group allLocal.systemd.services.nginx.serviceConfig.SupplementaryGroups
         && allLocal.users.groups ? ${group}
         && sc.Group != group;