From 91ab976beea2146b8a65468b4c619460139e1572 Mon Sep 17 00:00:00 2001 From: rpotter6298 Date: Sun, 30 Aug 2026 14:33:23 +0200 Subject: [PATCH] Set PYTHONSAFEPATH=1 in the units The repos now sit directly under /srv/astrape, which is also every unit's WorkingDirectory. Python prepends the working directory to sys.path for 'python -m', so the gibil checkout at /srv/astrape/gibil was shadowing the installed package: the repo root has no __init__.py, so 'gibil' resolved as a namespace portion with __file__ None, and submodules only resolved because a namespace path recomputes itself on access. Everything is installed into the venv, so nothing needs the working directory on sys.path. WorkingDirectory still matters for env/ and models/. Co-Authored-By: Claude Opus 5 (1M context) --- deploy/systemd/astrape-sigen.service | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/deploy/systemd/astrape-sigen.service b/deploy/systemd/astrape-sigen.service index 62fb8d8..b03552e 100644 --- a/deploy/systemd/astrape-sigen.service +++ b/deploy/systemd/astrape-sigen.service @@ -10,6 +10,12 @@ Group=gibil WorkingDirectory=/srv/astrape Environment=PYTHONUNBUFFERED=1 Environment=PYTHONDONTWRITEBYTECODE=1 +# WorkingDirectory is /srv/astrape, which also holds the gibil checkout. Without +# this, Python prepends the working directory to sys.path and the repo root +# /srv/astrape/gibil shadows the installed package as a namespace portion -- +# gibil.__file__ becomes None and imports work only by accident. All code is +# installed into the venv, so nothing needs the working directory on sys.path. +Environment=PYTHONSAFEPATH=1 ExecStart=/srv/astrape/.venv/bin/python -m astrape_ems.scripts.daemons.plant_daemon Restart=always