From c7ea495bf947833bb3d7429ba1bd208c21e08910 Mon Sep 17 00:00:00 2001 From: atlas Date: Thu, 4 Jun 2026 09:53:05 +0200 Subject: [PATCH] =?UTF-8?q?docs(priv=5Fproto):=20update=20ReloadGatewayNgi?= =?UTF-8?q?nx=20comment=20=E2=80=94=20state-aware=20dispatch?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The implementation now queries ActiveState and dispatches reload/ reset-start/start rather than blindly calling systemd-run nginx -s reload. Clarify that machine-bus transport requires root. --- hive-sh4re/src/priv_proto.rs | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/hive-sh4re/src/priv_proto.rs b/hive-sh4re/src/priv_proto.rs index 3638084c..288d53c1 100644 --- a/hive-sh4re/src/priv_proto.rs +++ b/hive-sh4re/src/priv_proto.rs @@ -182,8 +182,13 @@ pub enum PrivRequest { /// Run `systemctl daemon-reload`. DaemonReload, - /// Reload nginx inside the `hive-gateway` container via - /// `systemd-run --machine=hive-gateway nginx -s reload`. + /// Synchronise the nginx unit inside the `hive-gateway` container. + /// hive-priv queries `ActiveState` and dispatches: + /// - `active` → `systemctl reload nginx` (SIGHUP, zero-downtime) + /// - `failed` → `systemctl reset-failed nginx` + `systemctl start nginx` + /// - otherwise → `systemctl start nginx` + /// Requires root: `--machine=hive-gateway` enters the container + /// namespace via the machine bus (forbidden for unprivileged users). ReloadGatewayNginx, // --- Socket dir ownership ---