hive-c0re/src/gateway_nginx.rs

@@ -290,17 +290,42 @@ fn reload_gateway_nginx() {
     let state = nginx_active_state();
     let success = match state.as_str() {
         "active" => {
-            // nginx master is running — ask systemd to reload the unit
+            // nginx master is running — SIGHUP is the zero-downtime path.
-            // (SIGHUP to master, zero-downtime worker replacement).
+            // `systemd-run --machine=hive-gateway --quiet --wait -- nginx
-            // `systemctl -M hive-gateway reload nginx` lets systemd
+            // -s reload` runs the signal inside the container and exits
-            // resolve the binary path; avoids the exit-203 (EXEC)
+            // with the nginx exit code. `--` separates systemd-run flags
-            // failure that `systemd-run -- nginx` hit on NixOS where
+            // from the command.
-            // the limited transient-unit PATH misses /run/current-system/sw/bin/.
+            let status = std::process::Command::new("systemd-run")
-            let ok = gateway_systemctl(&["reload", "nginx"]);
+                .args([
-            if ok {
+                    "--machine=hive-gateway",
-                tracing::debug!("gateway nginx reload signal sent");
+                    "--quiet",
+                    "--wait",
+                    "--",
+                    "nginx",
+                    "-s",
+                    "reload",
+                ])
+                .status();
+            match status {
+                Ok(s) if s.success() => {
+                    tracing::debug!("gateway nginx reload signal sent");
+                    true
+                }
+                Ok(s) => {
+                    tracing::warn!(
+                        exit_code = ?s.code(),
+                        "gateway nginx reload exited non-zero — will retry next poll tick"
+                    );
+                    false
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        error = %e,
+                        "failed to invoke systemd-run for gateway nginx reload — will retry"
+                    );
+                    false
+                }
             }
-            ok
         }
         "failed" => {
             // Unit hit start-limit (e.g. repeated nginx -t failures from

nix/modules/hive-gateway.nix

@@ -421,8 +421,7 @@ in
           };
 
           # nginx reload is triggered from the HOST side by hive-c0re
-          # via `systemctl -M hive-gateway reload nginx` — lets systemd
+          # via `systemd-run --machine=hive-gateway nginx -s reload`
-          # resolve the nginx binary path, avoiding exit-203 EXEC failures.
           # after each agents.conf write. A path unit watching the
           # bind-mounted file inside the container was tried first
           # (A path unit inside the container was tried but IN_MOVED_TO from an atomic rename on the host