nixos module: non-empty SetCredential fallbacks (systemd 260) #22

Manually merged

krisbuild merged 1 commit from setcredential-fallback into main 2026-09-27 21:29:58 +02:00

Conversation 2 Commits 1 Files changed 1 +5 -2

kris commented 2026-09-27 20:13:46 +02:00

Owner

Copy link

The agent unit's SetCredential= fallbacks were empty (cp-token:, forge-token:). systemd 260 rejects that as invalid syntax and ignores the line (Invalid syntax, ignoring: forge-token:). As a result, a missing token file fails credential setup with 243/CREDENTIALS and a crash loop, instead of reaching the preflight's readable error. This was seen live on ares with the same pattern in pixienix's attic-token wiring, which is fixed there separately.

The placeholder value is now missing. The preflight stats the source files, so the placeholder is never used as a token. The nixos-module check builds.

🤖 Generated with Claude Code

The agent unit's `SetCredential=` fallbacks were empty (`cp-token:`, `forge-token:`). systemd 260 rejects that as invalid syntax and ignores the line (`Invalid syntax, ignoring: forge-token:`). As a result, a missing token file fails credential setup with `243/CREDENTIALS` and a crash loop, instead of reaching the preflight's readable error. This was seen live on ares with the same pattern in pixienix's attic-token wiring, which is fixed there separately. The placeholder value is now `missing`. The preflight stats the source files, so the placeholder is never used as a token. The `nixos-module` check builds. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

kris added 1 commit 2026-09-27 20:13:46 +02:00

nixos module: non-empty SetCredential fallbacks for agent credentials ... a5ecfe7688

systemd 260 rejects an empty SetCredential= value (`cp-token:`) as invalid
syntax and drops it, so a missing token file failed credential setup
(243/CREDENTIALS) instead of reaching the preflight's legible error.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

kris commented 2026-09-27 20:13:52 +02:00

Author

Owner

Copy link

Two-line module fix; nixos-module check builds locally.

@krisbuild r+

Two-line module fix; `nixos-module` check builds locally. @krisbuild r+

krisbuild referenced this pull request from a commit 2026-09-27 21:29:41 +02:00

Auto merge of #22 - nixos module: non-empty SetCredential fallbacks (systemd 260), r=kris

krisbuild manually merged commit 214f223466 into main 2026-09-27 21:29:58 +02:00

krisbuild commented 2026-09-27 21:29:58 +02:00

Collaborator

Copy link

Merged as 214f223466.

Merged as 214f223466e5.

kris referenced this pull request from a commit 2026-09-27 22:02:08 +02:00

Merge origin/main (#10 enrollment, #8 node health, #22)

kris referenced this pull request from a commit 2026-09-27 22:03:36 +02:00

Merge origin/main into lu/protocol-handshake

kris referenced this pull request 2026-09-27 22:38:44 +02:00

Per-node attic push tokens issued by the control plane (SPEC §7.3.1) #13

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kris/krisbuild!22

No description provided.