vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: chgrp the runtime dir in ExecStartPost, ExecStart's setup undid the ExecStartPre one

Browse source
This commit is contained in:
müde 2026-10-18 15:32:35 +02:00
commit a6147dc875
2 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/swarm-controller.nix
View file

@ -727,11 +727,12 @@ in
# 0750 with the group set to `clientsGroup` below: only nginx and
# root can reach the socket inside.
RuntimeDirectoryMode = "0750";
# systemd chowns the runtime directory to `User:Group` on every
# start, and the daemon is not a member of `clientsGroup`, so it
# cannot chgrp the directory itself. `+` runs this as root, after
# that chown.
ExecStartPre = "+${pkgs.coreutils}/bin/chgrp ${clientsGroup} ${builtins.dirOf deployCfg.swarm-controller.socketPath}";
# systemd re-chowns the runtime directory to `User:Group` while
# setting up every command, `ExecStart` included, so a chgrp in
# `ExecStartPre` is undone. The daemon is not a member of
# `clientsGroup` and cannot chgrp it itself; `+` runs this as root,
# after the last chown.
ExecStartPost = "+${pkgs.coreutils}/bin/chgrp ${clientsGroup} ${builtins.dirOf deployCfg.swarm-controller.socketPath}";
# Preserved across restarts so the path never vanishes from under a
# running nginx. The daemon unlinks a stale socket on start, which
# is what makes preservation safe.

4
nix/module-eval/core-toggle.nix
View file

@ -449,8 +449,8 @@ let
group = "swarm-controller-clients";
in
sc.RuntimeDirectoryMode == "0750"
&& lib.hasPrefix "+" sc.ExecStartPre
&& lib.hasInfix "chgrp ${group} /run/swarm-controller" sc.ExecStartPre
&& lib.hasPrefix "+" sc.ExecStartPost
&& lib.hasInfix "chgrp ${group} /run/swarm-controller" sc.ExecStartPost
&& lib.elem group allLocal.systemd.services.nginx.serviceConfig.SupplementaryGroups
&& allLocal.users.groups ? ${group}
&& sc.Group != group;