From abcd4e9e0bbdf1b1bef6fc55fc2f250bce2f69ad Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Mon, 10 Aug 2026 13:29:00 +0200 Subject: [PATCH] fix(hermes): give the agent's data volume its container's ownership on NFS The agent runs as uid 10000 and keeps its kanban state in embedded SQLite. Without an nfs block the export directory is created root:root, no_root_squash helps only root, and uid 10000 gets EACCES, which SQLite reports as "attempt to write a readonly database". Concurrent writers would report "database is locked" instead, which is how the two apart. Compose has no NFS bind, which is why only swarm failed. An earlier series gave five other non-root roles the same block; this role was the one left out. replicas: 1 stays as hardening, not as the fix: once the writes land, three replicas contend for one SQLite writer lock. --- roles/web-app-hermes/meta/services.yml | 2 ++ roles/web-app-hermes/meta/volumes.yml | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/roles/web-app-hermes/meta/services.yml b/roles/web-app-hermes/meta/services.yml index 9364149e84..0886fde2e1 100644 --- a/roles/web-app-hermes/meta/services.yml +++ b/roles/web-app-hermes/meta/services.yml @@ -6,6 +6,8 @@ hermes: enabled: true swarm: enabled: true + # nocheck: single-replica the agent keeps its kanban state in embedded SQLite on one shared volume, and SQLite takes a single writer lock per file, so concurrent replicas serialise into "database is locked" instead of sharing the work + replicas: 1 bond: 1 enabled: true shared: true diff --git a/roles/web-app-hermes/meta/volumes.yml b/roles/web-app-hermes/meta/volumes.yml index b03f6f19d6..29a227a8ad 100644 --- a/roles/web-app-hermes/meta/volumes.yml +++ b/roles/web-app-hermes/meta/volumes.yml @@ -1,6 +1,10 @@ --- hermes_data: type: volume + nfs: + uid: "10000" + gid: "10000" + mode: "0770" mounts: - service: hermes target: /opt/data