vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

say that the backend env leaf and file are agent-writable, and why that is accepted

Browse source
This commit is contained in:
atlas 2026-10-27 22:12:52 +01:00
commit be3a3af093
1 changed files with 22 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/agent-modules/agent-service.nix
View file

@ -192,7 +192,10 @@ in
read-write for recovery — see `docs/agent-lifecycle/persistence.md`'s "Cross-agent access to
state"), so this credential is reachable by nothing but this agent
and the host. Permissions should be `0600`, owned by the agent's
unix user. Loaded with a leading `-` (optional `EnvironmentFile`),
unix user. Whatever owner it was installed with, the file becomes
agent-owned at the container's next boot, so the agent can rewrite it;
it is no boundary the agent can't cross until the swarm secret store
replaces the file. Loaded with a leading `-` (optional `EnvironmentFile`),
so a path that doesn't exist yet — an operator setting this option
before creating the file, or a fresh host rebuild before state is
restored — makes systemd skip it rather than refuse to start the