From 65f89806cb837bdd7ca758c795de7c9ae9391ba9 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 20 Jul 2026 15:59:24 +1000 Subject: [PATCH] Fix beszel-agent losing its hub-pairing fingerprint on every restart services.beszel.agent runs under DynamicUser=true with ProtectSystem = "strict" and no StateDirectory, so /var/lib/beszel-agent -- where the agent persists the fingerprint that locks its hub pairing to this machine (github.com/henrygd/beszel/discussions/1542) -- was never actually writable. Every restart silently failed to persist it and regenerated a fresh one in memory, permanently desyncing from whatever the hub had on record after the very first successful pairing. Affects every host importing modules/beszel/enable-agent.nix (nix-cache, server), not just full container rebuilds. Found via nix-cache showing "fingerprint mismatch" after being rebuilt post-outage; confirmed server was silently exposed to the same bug, just hadn't restarted since its first pairing. Fixed by declaring StateDirectory so systemd gives the dynamic user real persistent storage. Co-Authored-By: Claude Sonnet 5 --- modules/beszel/enable-agent.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/modules/beszel/enable-agent.nix b/modules/beszel/enable-agent.nix index 10da5ca..0770f74 100644 --- a/modules/beszel/enable-agent.nix +++ b/modules/beszel/enable-agent.nix @@ -6,4 +6,13 @@ #DOCKER_HOST = "tcp://docker-socket-proxy:2375"; HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.ports.beszelHub}"; }; + + # The upstream module runs beszel-agent under DynamicUser with + # ProtectSystem = "strict" and no StateDirectory, so /var/lib/beszel-agent + # (where the agent persists its hub-pairing fingerprint, per + # https://github.com/henrygd/beszel/discussions/1542) isn't writable -- + # every restart silently fails to save it and regenerates a fresh one in + # memory, permanently desyncing from whatever the hub has on record after + # the very first successful pairing. Give it real persistent storage. + systemd.services.beszel-agent.serviceConfig.StateDirectory = "beszel-agent"; }