1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
[Unit]
Description=MeshBay Node — P2P file host, streaming, and chat
Documentation=https://meshbay.org/docs
After=network-online.target
Wants=network-online.target
# The per-user unit, for the desktop persona.
#
# Its sibling `meshbay-node.service` is a SYSTEM template with `User=%i`, which
# root instantiates once per person (`systemctl enable --now meshbay-node@alice`)
# — the ordinary gesture on a server. That is the wrong shape for someone
# running a node on their own machine: it needs a password they should not have
# to give, for a service that only ever runs as them.
#
# This one is enabled by the person themselves, and therefore by the desktop
# client on their behalf:
#
# systemctl --user enable --now meshbay-node
# loginctl enable-linger $USER # keep serving when logged out
#
# A user unit cannot carry User= or Group= — it already runs as its owner.
[Service]
Type=simple
# Secrets: MESHBAY_UNLOCK_KEY (keystore). MESHBAY_PASSWORD is no longer read —
# the node authenticates to the hub with an Ed25519 signature (NS7).
# MESHBAY_TMDB_DEFAULT_TOKEN (Videos app, optional) also lives here — never
# in source. Absent means TMDB lookups are inert until the operator sets one
# here or configures a custom token in Settings (docs/mediacenter.md §5.5).
# MESHBAY_MUSICBRAINZ_CONTACT_DEFAULT (Music app, optional) lives here too,
# same reasoning — not a credential (MusicBrainz needs none), but still
# never a literal value in source: it's a personal contact address sent
# as-is in every request's User-Agent (docs/musicbay.md §3.2). Absent means
# MusicBrainz lookups are inert until the operator sets one here or
# configures a contact in Settings.
EnvironmentFile=-%h/.config/meshbay/node.env
ExecStart=/usr/bin/meshbay-node --config %h/.config/meshbay/node.toml
# The client asks for a reload after changing a group's directories, and that
# must not drop a member who is watching a film.
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=10
TimeoutStopSec=30
# Data: chat DBs, roster, indexes — ~/.local/share/meshbay/
StateDirectory=meshbay
# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=false
ReadWritePaths=%h/.config/meshbay %h/.local/share/meshbay
# A directory shared from outside the home — an external drive, another
# partition — is added by a drop-in the client writes, rather than by weakening
# ProtectSystem:
#
# ~/.config/systemd/user/meshbay-node.service.d/paths.conf
# [Service]
# ReadWritePaths=/run/media/%u/Films
# RequiresMountsFor=/run/media/%u/Films
#
# RequiresMountsFor matters as much as the path: a unit with ProtectSystem gets
# its own mount namespace, so a volume mounted on the host *after* this service
# started is invisible inside it — the directory reads as empty even when
# everything else is right.
[Install]
WantedBy=default.target
|