Aleksandr BogomiakovandClaude
0cfc1cbafc
The tray icon is dark red with no connection (or a lost exit node), blue when connected and green while an exit node is in use; the windows get the logo and an app id that matches the desktop entry, and the exit icon moves to the bottom left of the tile. Exit-node and broadcast firewall rules fall back to being recognised by their shape on kernels that have no `comment` match, as small router builds do. The macOS archive carries Tsunagi.app for the Homebrew cask, and the daemon plist opens the control socket to the admin group. Co-Authored-By: Claude <noreply@anthropic.com>
61 lines
2.1 KiB
Plaintext
61 lines
2.1 KiB
Plaintext
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
|
|
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<!--
|
|
LaunchDaemon for the tsunagi agent.
|
|
|
|
A daemon, so it runs as root (creating a utun interface and writing
|
|
/etc/resolver both need it) and comes up at boot before anyone logs in.
|
|
Install it at /Library/LaunchDaemons/cy.hexor.tsunagi.plist, owned by
|
|
root:wheel with mode 0644 — launchd refuses a daemon plist that is
|
|
group- or world-writable. See README.md in this directory.
|
|
|
|
Edit the binary path if tsng is not at /usr/local/bin/tsng.
|
|
-->
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>Label</key>
|
|
<string>cy.hexor.tsunagi</string>
|
|
|
|
<!-- `up` starts the agent and keeps it in the foreground, which is what a
|
|
launchd daemon expects: launchd owns the lifecycle, so the process
|
|
must not daemonise itself. -->
|
|
<key>ProgramArguments</key>
|
|
<array>
|
|
<string>/usr/local/bin/tsng</string>
|
|
<string>up</string>
|
|
</array>
|
|
|
|
<!-- Start at boot and bring it back if it ever exits. -->
|
|
<key>RunAtLoad</key>
|
|
<true/>
|
|
<key>KeepAlive</key>
|
|
<true/>
|
|
|
|
<!-- Back off rather than spin if it fails to start repeatedly. -->
|
|
<key>ThrottleInterval</key>
|
|
<integer>10</integer>
|
|
|
|
<!-- The control socket belongs to the admin group, so the CLI and the tray
|
|
work without sudo for any administrator. A plain account is not in it
|
|
and cannot manage the agent. -->
|
|
<key>EnvironmentVariables</key>
|
|
<dict>
|
|
<key>TSUNAGI_CONTROL_GROUP</key>
|
|
<string>admin</string>
|
|
</dict>
|
|
|
|
<!-- Logs. launchd creates these as root; rotate them with newsyslog if you
|
|
keep the daemon around. -->
|
|
<key>StandardOutPath</key>
|
|
<string>/var/log/tsunagi.log</string>
|
|
<key>StandardErrorPath</key>
|
|
<string>/var/log/tsunagi.log</string>
|
|
|
|
<!-- The agent uses the fixed macOS system paths by default:
|
|
state /var/db/tsunagi
|
|
socket /var/run/tsunagi/agent.sock
|
|
so nothing here has to point at a user's home directory. -->
|
|
</dict>
|
|
</plist>
|