RuntimeDirectoryPreserve=yes (0.1.7) made systemd privatise the
directory under DynamicUser: /run/varde became a symlink into
/run/private, 0700, and no unprivileged client - the redoal relay, a
desktop app - could connect. Without RuntimeDirectory= on the service
the socket unit creates the directory (DirectoryMode=0755), nothing
removes it on a service stop, and nothing privatises it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
iroh 1.0.2 -> 1.3.0 (relay reconnects that keep answering, rate-limit
notices from relays, the n0 DNS resolver with configurable fallbacks,
relay connection metrics), iroh-mdns-address-lookup 0.4 -> 0.6,
n0-future 0.1 -> 0.3. No code changes were needed; the suite passes.
varde.service now keeps /run/varde across restarts
(RuntimeDirectoryPreserve=yes): stopping the service removed the
directory and with it the socket unit's file, leaving varde.socket
"active" on an unlinked path after any service restart. The install
notes say to restart the socket, which cycles both.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
dist/arch/PKGBUILD packages the release tarballs: system and per-user
units, the per-user socket on for every session (as PipeWire's is; the
daemon starts only when an app connects), config and man pages. The
release workflow publishes it for x86_64 and aarch64 from klokka.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- cargo fmt across the workspace (the CI gate the last push tripped).
- varde-daemon: drop the now-unused bytes dependency.
- varde-ctl(1): document push; gc reflects the continuous-sweep
reality; subscribe mentions push events.
- config.toml example: gc_interval_secs, and an honest note that
max_download_bytes_per_sec is currently unenforced.
- LICENSE-MIT + LICENSE-APACHE at the root (the declared license now
ships as files), bundled into release tarballs and installed by the
PKGBUILD.
- PKGBUILD: real maintainer, AUR pre-flight note (updpkgsums), license
installation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- release.toml: one shared workspace version, single vX.Y.Z tag,
full test suite as the pre-release gate, no crates.io publishing.
- .gitea/workflows/ci.yml: the Woodpecker quality bar (fmt, clippy
-D warnings, tests) for repos served by act_runner.
- .gitea/workflows/release.yml: on a version tag, build stripped
release binaries for x86_64 and aarch64 Linux, bundle them with the
systemd units, rendered man pages and example config, and attach the
tarballs (+ sha256) to a Gitea release via the API.
- dist/PKGBUILD: point at the repo's new home on project.uhhm.no.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Metered detection polls NetworkManager's Metered property over D-Bus
(feature "metered", default on; builds without D-Bus via
no-default-features). While metered the daemon closes incoming blob
connections and defers every fetch; VARDE_FORCE_METERED=true forces the
state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1
best-effort by matching bound ports to /proc/net/udp inodes (iroh hides
its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness
is a hand-rolled sd_notify READY=1 (abstract + path sockets), and
standalone binding still works unchanged. dist/ ships hardened system
and user units (DynamicUser, ProtectSystem=strict, StateDirectory,
RestrictAddressFamilies), a commented config example, scdoc man pages
validated with scdoc, and an untested PKGBUILD skeleton.
Tests: activation-socket round trip via a real fd-3 handoff, READY=1
received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch.
Dependencies: zbus (optional, feature-gated D-Bus client for the
NetworkManager metered flag).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
