From d332b30be76dd90902cc73e27514ff92613b3846 Mon Sep 17 00:00:00 2001 From: rpotter6298 Date: Sun, 30 Aug 2026 14:33:27 +0200 Subject: [PATCH] Set PYTHONSAFEPATH=1 in the units The repos now sit directly under /srv/astrape, which is also every unit's WorkingDirectory. Python prepends the working directory to sys.path for 'python -m', so the gibil checkout at /srv/astrape/gibil was shadowing the installed package: the repo root has no __init__.py, so 'gibil' resolved as a namespace portion with __file__ None, and submodules only resolved because a namespace path recomputes itself on access. Everything is installed into the venv, so nothing needs the working directory on sys.path. WorkingDirectory still matters for env/ and models/. Co-Authored-By: Claude Opus 5 (1M context) --- deploy/systemd/astrape-web.service | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/deploy/systemd/astrape-web.service b/deploy/systemd/astrape-web.service index 6babf92..2adecc3 100644 --- a/deploy/systemd/astrape-web.service +++ b/deploy/systemd/astrape-web.service @@ -10,6 +10,12 @@ Group=gibil WorkingDirectory=/srv/astrape Environment=PYTHONUNBUFFERED=1 Environment=PYTHONDONTWRITEBYTECODE=1 +# WorkingDirectory is /srv/astrape, which also holds the gibil checkout. Without +# this, Python prepends the working directory to sys.path and the repo root +# /srv/astrape/gibil shadows the installed package as a namespace portion -- +# gibil.__file__ becomes None and imports work only by accident. All code is +# installed into the venv, so nothing needs the working directory on sys.path. +Environment=PYTHONSAFEPATH=1 ExecStart=/srv/astrape/.venv/bin/python -m astrape_dashboard.scripts.daemons.web_daemon Restart=always