Set PYTHONSAFEPATH=1 in the units

The repos now sit directly under /srv/astrape, which is also every unit's
WorkingDirectory. Python prepends the working directory to sys.path for
'python -m', so the gibil checkout at /srv/astrape/gibil was shadowing the
installed package: the repo root has no __init__.py, so 'gibil' resolved as a
namespace portion with __file__ None, and submodules only resolved because a
namespace path recomputes itself on access.

Everything is installed into the venv, so nothing needs the working directory
on sys.path. WorkingDirectory still matters for env/ and models/.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
rpotter6298
2026-08-30 14:33:23 +02:00
parent 438952f7f2
commit 91ab976bee
+6
View File
@@ -10,6 +10,12 @@ Group=gibil
WorkingDirectory=/srv/astrape WorkingDirectory=/srv/astrape
Environment=PYTHONUNBUFFERED=1 Environment=PYTHONUNBUFFERED=1
Environment=PYTHONDONTWRITEBYTECODE=1 Environment=PYTHONDONTWRITEBYTECODE=1
# WorkingDirectory is /srv/astrape, which also holds the gibil checkout. Without
# this, Python prepends the working directory to sys.path and the repo root
# /srv/astrape/gibil shadows the installed package as a namespace portion --
# gibil.__file__ becomes None and imports work only by accident. All code is
# installed into the venv, so nothing needs the working directory on sys.path.
Environment=PYTHONSAFEPATH=1
ExecStart=/srv/astrape/.venv/bin/python -m astrape_ems.scripts.daemons.plant_daemon ExecStart=/srv/astrape/.venv/bin/python -m astrape_ems.scripts.daemons.plant_daemon
Restart=always Restart=always