2026-10-02 11:48:19 +01:00
|
|
|
[Unit]
|
|
|
|
|
Description=tsunagi mesh agent
|
2026-10-02 23:29:51 +01:00
|
|
|
Documentation=https://github.com/house-of-vanity/tsunagi
|
2026-10-02 11:48:19 +01:00
|
|
|
After=network-online.target
|
|
|
|
|
Wants=network-online.target
|
|
|
|
|
|
|
|
|
|
[Service]
|
|
|
|
|
Type=simple
|
2026-10-02 13:46:27 +01:00
|
|
|
# Runs as a dedicated unprivileged user, not root. The two capabilities are all
|
|
|
|
|
# it needs: CAP_NET_ADMIN to create and configure the TUN interface, and
|
|
|
|
|
# CAP_NET_BIND_SERVICE for low ports. The packages create the `tsunagi` user.
|
|
|
|
|
User=tsunagi
|
|
|
|
|
Group=tsunagi
|
|
|
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
|
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
|
|
|
|
|
|
|
|
# systemd creates and owns these for the service user, and the agent is pointed
|
|
|
|
|
# at them: state in /var/lib/tsunagi, cache in /var/cache/tsunagi, and the
|
2026-10-02 23:29:51 +01:00
|
|
|
# control socket in /run/tsunagi. The socket is opened to the `tsunagi` group,
|
|
|
|
|
# so a user who joins it can run the CLI and the tray without sudo.
|
2026-10-02 13:46:27 +01:00
|
|
|
StateDirectory=tsunagi
|
|
|
|
|
StateDirectoryMode=0700
|
|
|
|
|
CacheDirectory=tsunagi
|
|
|
|
|
RuntimeDirectory=tsunagi
|
|
|
|
|
RuntimeDirectoryMode=0755
|
|
|
|
|
Environment=TSUNAGI_STATE_DIR=%S/tsunagi
|
|
|
|
|
Environment=TSUNAGI_CACHE_DIR=%C/tsunagi
|
|
|
|
|
Environment=TSUNAGI_CONTROL_SOCKET=%t/tsunagi/agent.sock
|
2026-10-02 23:29:51 +01:00
|
|
|
Environment=TSUNAGI_CONTROL_GROUP=tsunagi
|
2026-10-02 13:46:27 +01:00
|
|
|
|
|
|
|
|
# The tarball installer puts the binary here; the deb and the Arch package
|
|
|
|
|
# rewrite this to /usr/bin where they install it.
|
2026-10-02 11:48:19 +01:00
|
|
|
ExecStart=/usr/local/bin/tsunagi up
|
|
|
|
|
Restart=on-failure
|
|
|
|
|
RestartSec=5
|
|
|
|
|
|
|
|
|
|
[Install]
|
|
|
|
|
WantedBy=multi-user.target
|
