From ecf8b5974a221cb53a259b4dc85ce77cf810b87f Mon Sep 17 00:00:00 2001
From: chexit <chexit@duck.com>
Date: Sun, 19 Apr 2026 18:17:24 +0300
Subject: [PATCH] fix(yami): tmpfiles for runner token must use root
 (DynamicUser has no static user)

---
 yami-dev-stack.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/yami-dev-stack.nix b/yami-dev-stack.nix
index 19e1041..5986d48 100644
--- a/yami-dev-stack.nix
+++ b/yami-dev-stack.nix
@@ -142,9 +142,10 @@ in
       requires = [ "gitea.service" "docker.service" ];
     };
 
-    # Directory for the runner token file; owner matches the runner service user.
+    # Runner uses DynamicUser, so there's no static gitea-runner user/group.
+    # The token file is read by the root-run pre-start, so root owns it.
     systemd.tmpfiles.rules = [
-      "d /var/lib/gitea-runner 0700 gitea-runner gitea-runner -"
+      "d /var/lib/gitea-runner 0700 root root -"
     ];
 
     # ── Shell aliases ──────────────────────────────────────────────────────────