The NixOS module started a second host in root's systemd, which stole the ports from the real one #218

Merged

enricobuehler merged 2 commits from worktree-nixos-module-user-scoping into main 2026-08-14 09:17:56 +00:00

Conversation 0 Commits 2 Files Changed 4

+121 -2

2 Commits

Author	SHA1	Message	Date
enricobuehler	e8bc10bf0c	Merge remote-tracking branch 'origin/main' into worktree-nixos-module-user-scoping ... # Conflicts: # CHANGELOG.md	2026-08-14 11:16:49 +02:00
enricobuehler	4499313749	fix(nix): the module started a second host in root's systemd, stealing the ports from the real one ... `systemd.user.*` has no per-user form in NixOS — it installs units into every user's manager. With `host.autoStart` adding them to `default.target`, that included root, whose `user@0.service` exists the moment anybody SSHes in as root. Root's host won the race for the fixed ports and the desktop user's copy crash-looped forever on `bind RTSP 48010: Address already in use`. Every other listener binds first and logs success, so the log reads like a clash with an unrelated program; a second copy of itself running as root is the last thing you look for. `host.users` did not help — it only granted input/punktfunk group membership and never scoped the units. Render `ConditionUser=` on all four user units from `host.users`. Entries are written `|user`: the pipe makes each a triggering condition, which systemd ORs, where plain repeated `ConditionUser=` lines are ANDed and would match nobody. With `host.users` empty, fall back to `!@system` — still keeps root out while leaving the manual `systemctl --user enable --now` route working for a login. module-check.nix gains three assertions covering both branches and web-init keeping its non-triggering ConditionPathExists alongside the new condition. They run in nix.yml's eval leg, and were confirmed to fail against the unfixed module (2 of 23) before being committed. Verified on the box that found this: root force-starting the host now yields ConditionResult=no.	2026-08-14 11:00:43 +02:00