diff options
Diffstat (limited to 'packaging')
| -rw-r--r-- | packaging/README.md | 2 | ||||
| -rwxr-xr-x | packaging/build/build-node.sh | 11 | ||||
| -rw-r--r-- | packaging/win/build-node-runtime.ps1 | 8 |
3 files changed, 11 insertions, 10 deletions
diff --git a/packaging/README.md b/packaging/README.md index b65d0ed..6081fc7 100644 --- a/packaging/README.md +++ b/packaging/README.md @@ -95,7 +95,7 @@ no key-generation step to run by hand. ## Post-install (node) ```bash -meshbay-node init # copies default.env (with TMDB token) +meshbay-node init nano ~/.config/meshbay/node.toml systemctl --user enable --now meshbay-node ``` diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh index 8970176..fde67a5 100755 --- a/packaging/build/build-node.sh +++ b/packaging/build/build-node.sh @@ -45,8 +45,10 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node" # --- Node-specific assets ------------------------------------------------- mkdir -p "$ROOT/opt/meshbay-node/share" -# Default env with the shared TMDB token, read at build time and copied to -# <config>/node.env by `meshbay-node init`. +# Default env with the shared TMDB token, read at build time. The daemon reads +# it in place, beneath <config>/node.env, so it must be readable by whoever runs +# the node -- 0600 root made it unreadable to every per-user node. It is the +# same token in every copy of the package, so 0644 hides nothing. # # tmdb.py sends `Authorization: Bearer`, so this is the v4 *read access token* # (a JWT, "eyJ..."), not the 32-char v3 API key that sits beside it in the same @@ -72,13 +74,12 @@ fi if [ -n "$TMDB_TOKEN" ]; then cat > "$ROOT/opt/meshbay-node/share/default.env" <<EOF # Default environment for meshbay-node. -# Copied to <config>/node.env by 'meshbay-node init' if it does not exist. -# The operator may override any value there or in the systemd EnvironmentFile. +# Read by the daemon beneath <config>/node.env; set a value there to override it. # TMDB API token for the Videos app (read-only, shared across installations) MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN EOF - chmod 600 "$ROOT/opt/meshbay-node/share/default.env" + chmod 644 "$ROOT/opt/meshbay-node/share/default.env" echo " TMDB token baked into default.env (${#TMDB_TOKEN} chars)" elif [ "${MESHBAY_ALLOW_NO_TMDB:-0}" = "1" ]; then echo " !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" >&2 diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1 index 20eacc8..28c4061 100644 --- a/packaging/win/build-node-runtime.ps1 +++ b/packaging/win/build-node-runtime.ps1 @@ -120,9 +120,9 @@ else { # --- 5. default.env (shared TMDB token) ------------------------------ # Beside the exe, where platform.packaged_default_env() looks for it, and the -# same placement ffmpeg gets above. `meshbay-node init` copies it to -# %LOCALAPPDATA%\meshbay\node.env, and the daemon loads that file itself: -# Windows autostart is a Startup-folder .vbs, with no systemd EnvironmentFile. +# same placement ffmpeg gets above. The daemon reads it in place, beneath +# %LOCALAPPDATA%\meshbay\node.env: Windows autostart is a Startup-folder .vbs, +# with no systemd EnvironmentFile. function Get-TmdbToken([string]$File) { if (-not $File -or -not (Test-Path -LiteralPath $File)) { return "" } $lines = Get-Content -LiteralPath $File @@ -149,7 +149,7 @@ $noBom = New-Object System.Text.UTF8Encoding $false # a BOM would break parsin if ($tmdb) { $body = @( "# Default environment for meshbay-node.", - "# Copied to <config>\node.env by 'meshbay-node init' if it does not exist.", + "# Read by the daemon beneath <config>\node.env; set a value there to override it.", "", "# TMDB API token for the Videos app (read-only, shared across installations)", "MESHBAY_TMDB_DEFAULT_TOKEN=$tmdb" |