hydra-queue-runner: make per-machine tokens readable by the service
The per-machine queue-runner token secrets defaulted to root:root 0400, unreadable by the hydra-queue-runner user, so the runner skipped every token and fell back to accepting unauthenticated builders.
Jörg Thalheim committed
Jun 22, 2026 at 11:03 UTC
a5441e014ebef0a31e4d406c94b17295303c64ba
1 file changed
+2
build/hydra-queue-runner.nix
+2
@@ -34,6 +34,8 @@ in
34
machine:
35
lib.nameValuePair "${machine}-queue-runner-token" {
36
file = ./secrets/${machine}-queue-runner-token.age;
37
+ owner = "hydra-queue-runner";
38
+ group = "hydra";
39
}
40
) machines
41
);