Aleksandr BogomiakovandClaude
c62d29fa14
The control socket is now opened to the tsunagi group (unit), the Arch package enables and starts the service on install, adds the installing user to the group, restarts a running agent on upgrade, and depends on the libraries the tray loads at run time. The tray looks for the agent's socket again on every poll instead of once at start, and a missing indicator library is reported instead of panicking. Repository URLs unified. Co-Authored-By: Claude <noreply@anthropic.com>
39 lines
1.3 KiB
Desktop File
39 lines
1.3 KiB
Desktop File
[Unit]
|
|
Description=tsunagi mesh agent
|
|
Documentation=https://github.com/house-of-vanity/tsunagi
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Runs as a dedicated unprivileged user, not root. The two capabilities are all
|
|
# it needs: CAP_NET_ADMIN to create and configure the TUN interface, and
|
|
# CAP_NET_BIND_SERVICE for low ports. The packages create the `tsunagi` user.
|
|
User=tsunagi
|
|
Group=tsunagi
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
|
|
# systemd creates and owns these for the service user, and the agent is pointed
|
|
# at them: state in /var/lib/tsunagi, cache in /var/cache/tsunagi, and the
|
|
# control socket in /run/tsunagi. The socket is opened to the `tsunagi` group,
|
|
# so a user who joins it can run the CLI and the tray without sudo.
|
|
StateDirectory=tsunagi
|
|
StateDirectoryMode=0700
|
|
CacheDirectory=tsunagi
|
|
RuntimeDirectory=tsunagi
|
|
RuntimeDirectoryMode=0755
|
|
Environment=TSUNAGI_STATE_DIR=%S/tsunagi
|
|
Environment=TSUNAGI_CACHE_DIR=%C/tsunagi
|
|
Environment=TSUNAGI_CONTROL_SOCKET=%t/tsunagi/agent.sock
|
|
Environment=TSUNAGI_CONTROL_GROUP=tsunagi
|
|
|
|
# The tarball installer puts the binary here; the deb and the Arch package
|
|
# rewrite this to /usr/bin where they install it.
|
|
ExecStart=/usr/local/bin/tsunagi up
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|