diff options
Diffstat (limited to 'packaging/rpm')
| -rw-r--r-- | packaging/rpm/meshbay-hub.spec | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/packaging/rpm/meshbay-hub.spec b/packaging/rpm/meshbay-hub.spec index 73df0b9..50bd977 100644 --- a/packaging/rpm/meshbay-hub.spec +++ b/packaging/rpm/meshbay-hub.spec @@ -32,7 +32,11 @@ getent passwd meshbay >/dev/null || \ %systemd_post meshbay-hub.service install -d -o meshbay -g meshbay -m 750 /var/lib/meshbay/hub install -d -o meshbay -g meshbay -m 750 /var/log/meshbay -install -d -m 755 /etc/meshbay +# 750, not 755: this directory holds the hub's private key and its +# database password. The file modes protect the contents, but a +# world-listable config directory tells anyone with a shell what a +# hub keeps and where. The service reads it by group. +install -d -o root -g meshbay -m 750 /etc/meshbay %preun %systemd_preun meshbay-hub.service @@ -47,6 +51,13 @@ install -d -m 755 /etc/meshbay /opt/meshbay-common/venv/bin/meshbay-hub /usr/bin/meshbay-hub %{_unitdir}/meshbay-hub.service +# The example config, and the directory it lands in. Both have to be declared: +# build-hub.sh stages them, and rpmbuild fails the build on an installed file +# no %files line claims. %config so an operator's edits are kept as .rpmsave +# rather than silently replaced — it is under /etc, whatever its name says. +# The mode matches %post; the `meshbay` group exists by then, %pre makes it. +%dir %attr(0750, root, meshbay) /etc/meshbay +%config %attr(0644, root, meshbay) /etc/meshbay/hub.toml.example %changelog * Sun Aug 31 2026 MeshBay Team <team@meshbay.org> - %{version}-1 |