From c5c47b29b49dac07f4ea8d969c71a2e8e6f69667 Mon Sep 17 00:00:00 2001 From: damocles Date: Fri, 5 Jun 2026 23:30:50 +0200 Subject: [PATCH] fix: own /run/hive-agent as hive-core so the unprivileged daemon can create per-agent socket dirs on first launch --- nix/modules/hive-gateway.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index 2b97e4ca..16af376a 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -433,13 +433,17 @@ in # and cover the fresh-boot window before c0re has run. # # /run/hive-agent — per-agent UDS socket dir, written by c0re's - # set_nspawn_flags when agents start. + # set_nspawn_flags when agents start. Owned by `hive-core` (the + # unprivileged coordinator user, privsep phase 2): c0re does the + # `create_dir_all(/run/hive-agent/)` itself, so a root-owned + # parent would EACCES on the very first agent create on a fresh host + # (hive-priv only chowns the subdir afterwards, it doesn't make it). # /var/lib/hyperhive — hyperhive state dir, created by c0re on # first run. Also pre-seed agents.conf with an empty-but-valid # header so nginx can start + include the file before c0re writes # its first real content (f = create-if-absent, no overwrite). systemd.tmpfiles.rules = [ - "d /run/hive-agent 0755 root root - -" + "d /run/hive-agent 0755 hive-core hive-core - -" "d /var/lib/hyperhive 0755 root root - -" "d /var/lib/hyperhive/gateway 0755 root root - -" "f /var/lib/hyperhive/gateway/agents.conf 0644 root root - # Generated by hive-c0re — do not edit.\n"