Bendik Aagaard LynghaugandClaude Fable 5.1
08fcba749a
iroh 1.0.2 -> 1.3.0 (relay reconnects that keep answering, rate-limit notices from relays, the n0 DNS resolver with configurable fallbacks, relay connection metrics), iroh-mdns-address-lookup 0.4 -> 0.6, n0-future 0.1 -> 0.3. No code changes were needed; the suite passes. varde.service now keeps /run/varde across restarts (RuntimeDirectoryPreserve=yes): stopping the service removed the directory and with it the socket unit's file, leaving varde.socket "active" on an unlinked path after any service restart. The install notes say to restart the socket, which cycles both. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
43 lines
1.1 KiB
Desktop File
43 lines
1.1 KiB
Desktop File
# varde system service. Pairs with varde.socket for socket activation;
|
|
# also runs standalone (the daemon binds its own socket when not
|
|
# activated).
|
|
[Unit]
|
|
Description=varde content-addressed blob mirror daemon
|
|
Documentation=man:varde(8)
|
|
After=network.target
|
|
Requires=varde.socket
|
|
|
|
[Service]
|
|
Type=notify
|
|
ExecStart=/usr/bin/varde-daemon --system
|
|
Restart=on-failure
|
|
|
|
# Hardening
|
|
DynamicUser=yes
|
|
StateDirectory=varde
|
|
RuntimeDirectory=varde
|
|
# The socket unit's file lives in this directory: removing it on every
|
|
# service stop (the default) left varde.socket listening on an unlinked
|
|
# path after any restart - "active" with nothing to connect to.
|
|
RuntimeDirectoryPreserve=yes
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
CapabilityBoundingSet=
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|