vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: own /run/hive-agent as hive-core so the unprivileged daemon can create per-agent socket dirs on first launch

Browse source
This commit is contained in:
damocles 2026-06-05 23:30:50 +02:00
commit c5c47b29b4
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/modules/hive-gateway.nix
View file

@ -433,13 +433,17 @@ in
# and cover the fresh-boot window before c0re has run.
#
# /run/hive-agent — per-agent UDS socket dir, written by c0re's
# set_nspawn_flags when agents start.
# set_nspawn_flags when agents start. Owned by `hive-core` (the
# unprivileged coordinator user, privsep phase 2): c0re does the
# `create_dir_all(/run/hive-agent/<name>)` itself, so a root-owned
# parent would EACCES on the very first agent create on a fresh host
# (hive-priv only chowns the subdir afterwards, it doesn't make it).
# /var/lib/hyperhive — hyperhive state dir, created by c0re on
# first run. Also pre-seed agents.conf with an empty-but-valid
# header so nginx can start + include the file before c0re writes
# its first real content (f = create-if-absent, no overwrite).
systemd.tmpfiles.rules = [
"d /run/hive-agent 0755 root root - -"
"d /run/hive-agent 0755 hive-core hive-core - -"
"d /var/lib/hyperhive 0755 root root - -"
"d /var/lib/hyperhive/gateway 0755 root root - -"
"f /var/lib/hyperhive/gateway/agents.conf 0644 root root - # Generated by hive-c0re — do not edit.\n"