From 9b0788092514e3cd3439784c5398db8b72d2851f Mon Sep 17 00:00:00 2001
From: Padreug <padreug@aiolabs.dev>
Date: Sat, 10 Oct 2026 22:08:48 +0200
Subject: [PATCH] fix(deploy): the .env migration called sed and grep by bare
 name on the activation PATH
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

NixOS activation scripts run with a minimal PATH that has coreutils but
not gnugrep or gnused. On sintra the snippet printed its success line and
then failed with "sed: command not found" (127) — the keys were never
renamed, the new app booted on fallback config, and switch-to-
configuration exited 2. Both binaries are now referenced by store path.
---
 deploy/nixos/configuration.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/deploy/nixos/configuration.nix b/deploy/nixos/configuration.nix
index f016179..20e5742 100644
--- a/deploy/nixos/configuration.nix
+++ b/deploy/nixos/configuration.nix
@@ -488,8 +488,12 @@ in
   system.activationScripts.bitspire-env-migration = {
     deps = [ "users" ];
     text = ''
-      if [ -f /var/lib/bitspire/.env ] && grep -q '^VITE_LAMASSU_' /var/lib/bitspire/.env; then
-        sed -i 's/^VITE_LAMASSU_/VITE_BITSPIRE_/' /var/lib/bitspire/.env
+      # Activation scripts run with a minimal PATH (coreutils, not gnugrep /
+      # gnused) — the first run of this snippet died with "sed: command not
+      # found" after printing success, so reference both by store path.
+      if [ -f /var/lib/bitspire/.env ] \
+         && ${pkgs.gnugrep}/bin/grep -q '^VITE_LAMASSU_' /var/lib/bitspire/.env; then
+        ${pkgs.gnused}/bin/sed -i 's/^VITE_LAMASSU_/VITE_BITSPIRE_/' /var/lib/bitspire/.env
         echo "bitspire: migrated VITE_LAMASSU_* keys in /var/lib/bitspire/.env"
       fi
     '';