From c41feaa2f66335ac3d64592d79d4920672fcc787 Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Fri, 24 Jul 2026 23:54:53 -0700 Subject: [PATCH] infra/forgejo: give the LAN runner's PATH ~/.local/bin sops (and other user-installed CLI tools) live in ~/.local/bin, which isn't on systemd --user's default PATH. Once a host is flipped into SOPS-configured mode (the /etc/thermograph/secrets-env marker), render-secrets.sh's own render step fails outright ("sops not installed but this host is configured for SOPS secrets") even though it's installed for the interactive user -- the runner just can't see it. Found via the LAN dev daemon crash-looping on a missing THERMOGRAPH_AUTH_SECRET after dev.yaml correctly gained one. --- infra/deploy/forgejo/register-lan-runner.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/infra/deploy/forgejo/register-lan-runner.sh b/infra/deploy/forgejo/register-lan-runner.sh index 0f96f97..1296a1c 100755 --- a/infra/deploy/forgejo/register-lan-runner.sh +++ b/infra/deploy/forgejo/register-lan-runner.sh @@ -82,6 +82,11 @@ After=network-online.target [Service] WorkingDirectory=${RUNNER_DIR} +# CI job steps shell out to user-installed tools (sops, age, ...) that live in +# ~/.local/bin, not on systemd --user's default PATH. Without this, any +# workflow that needs one (e.g. render-secrets.sh once a host is +# SOPS-configured) fails with "not installed" even though it plainly is. +Environment=PATH=%h/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin ExecStart=${RUNNER_DIR}/forgejo-runner daemon -c config.yaml Restart=on-failure RestartSec=5