The socket unit owns /run/varde; the service names no runtime directory

RuntimeDirectoryPreserve=yes (0.1.7) made systemd privatise the
directory under DynamicUser: /run/varde became a symlink into
/run/private, 0700, and no unprivileged client - the redoal relay, a
desktop app - could connect. Without RuntimeDirectory= on the service
the socket unit creates the directory (DirectoryMode=0755), nothing
removes it on a service stop, and nothing privatises it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

dist/varde.service

@@ -15,11 +15,13 @@ Restart=on-failure
 # Hardening
 DynamicUser=yes
 StateDirectory=varde
-RuntimeDirectory=varde
-# The socket unit's file lives in this directory: removing it on every
-# service stop (the default) left varde.socket listening on an unlinked
-# path after any restart - "active" with nothing to connect to.
-RuntimeDirectoryPreserve=yes
+# No RuntimeDirectory= here: varde.socket creates /run/varde for its
+# socket file, and the service only uses the activation socket. With
+# RuntimeDirectory= on the service, stopping it removed the socket file
+# from under the socket unit (0.1.6 and earlier), and preserving it
+# (0.1.7/0.1.8) made systemd privatise the directory under DynamicUser -
+# /run/varde -> /run/private/varde, 0700 - so no unprivileged client
+# could connect at all.
 NoNewPrivileges=yes
 ProtectSystem=strict
 ProtectHome=yes

dist/varde.socket

@@ -5,6 +5,9 @@ Description=varde API socket
 [Socket]
 ListenStream=/run/varde/varde.sock
 SocketMode=0666
+# The directory is this unit's, world-readable, so clients of any user
+# reach the socket (see varde.service for why the service must not own it).
+DirectoryMode=0755
 
 [Install]
 WantedBy=sockets.target