diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-26 12:23:16 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-26 12:23:16 +0200 |
| commit | fc761e7df40eac828d4e9858fab56958078c928b (patch) | |
| tree | fc62061f70f374fcc8366d7ef15882a2d983ac9b /packaging/build | |
| parent | 1c07ae23f3694b972e307c50c9c09f1c429f2ea2 (diff) | |
| download | meshbay-fc761e7df40eac828d4e9858fab56958078c928b.tar.gz | |
fix(node): read the packaged TMDB token in place
A node onboarded by the desktop client never ran `init`, so default.env was
never copied to node.env; and default.env was 0600 root, unreadable to a
per-user node anyway. The daemon now loads it beneath node.env, 0644.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'packaging/build')
| -rwxr-xr-x | packaging/build/build-node.sh | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh index 8970176..fde67a5 100755 --- a/packaging/build/build-node.sh +++ b/packaging/build/build-node.sh @@ -45,8 +45,10 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node" # --- Node-specific assets ------------------------------------------------- mkdir -p "$ROOT/opt/meshbay-node/share" -# Default env with the shared TMDB token, read at build time and copied to -# <config>/node.env by `meshbay-node init`. +# Default env with the shared TMDB token, read at build time. The daemon reads +# it in place, beneath <config>/node.env, so it must be readable by whoever runs +# the node -- 0600 root made it unreadable to every per-user node. It is the +# same token in every copy of the package, so 0644 hides nothing. # # tmdb.py sends `Authorization: Bearer`, so this is the v4 *read access token* # (a JWT, "eyJ..."), not the 32-char v3 API key that sits beside it in the same @@ -72,13 +74,12 @@ fi if [ -n "$TMDB_TOKEN" ]; then cat > "$ROOT/opt/meshbay-node/share/default.env" <<EOF # Default environment for meshbay-node. -# Copied to <config>/node.env by 'meshbay-node init' if it does not exist. -# The operator may override any value there or in the systemd EnvironmentFile. +# Read by the daemon beneath <config>/node.env; set a value there to override it. # TMDB API token for the Videos app (read-only, shared across installations) MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN EOF - chmod 600 "$ROOT/opt/meshbay-node/share/default.env" + chmod 644 "$ROOT/opt/meshbay-node/share/default.env" echo " TMDB token baked into default.env (${#TMDB_TOKEN} chars)" elif [ "${MESHBAY_ALLOW_NO_TMDB:-0}" = "1" ]; then echo " !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" >&2 |