Dai Ha
380eb63277
deploy/fleetd.service started clean on fleet01 but broke the daemon in three ways nothing logs: ProtectSystem/ProtectHome/ProtectKernelTunables/ProtectControlGroups each put the unit in its own mount namespace, which blinds fleetd's lsof-based caller lookup and falls every caller back to ANONYMOUS; PrivateTmp=true silently no-ops the credential scrub the member pane depends on; and running java directly from ExecStart skips the login shell that sources the daemon's secrets, so it boots with empty credentials. Replace the unit with the version verified working on fleet01 for a day, and add the deploy/herdr.service companion unit it was already depending on via After=/Wants= but which did not exist in the repo. Add deploy/herdr-inner.sh as the login-shell template herdr.service's ExecStart wraps in a pty. Add SystemdUnitSafetyTest (fleetd/src/test/java/dev/ltms/fleet/deploy) to read both unit files from disk and fail if a forbidden mount-namespacing directive is active, PrivateTmp is true, or fleetd.service's ExecStart does not go through a login shell -- the only guard possible for a unit file with no compile step.
41 lines
1.7 KiB
Desktop File
41 lines
1.7 KiB
Desktop File
# fleetd #360 — systemd unit for herdr (Linux), the terminal multiplexer fleetd drives.
|
|
#
|
|
# This is fleetd.service's companion: fleetd.service's After=/Wants=herdr.service assumes this
|
|
# unit exists. Before this ticket it did not, so on a fresh host fleetd started against a herdr
|
|
# that systemd never supervised at all.
|
|
#
|
|
# Install: see deploy/fleetd.service's header comment (both units install the same way).
|
|
#
|
|
# ExecStart below runs deploy/herdr-inner.sh (copy the template of that name from this directory
|
|
# to the path in ExecStart, or point ExecStart at wherever you keep it, and make it executable).
|
|
# It is a separate file rather than an inline command because it must itself be a login shell (see
|
|
# its own header for why) and systemd's ExecStart does not run one.
|
|
|
|
[Unit]
|
|
Description=herdr terminal multiplexer (fleet session)
|
|
Documentation=https://git.ltms.dev/fleet/fleetd/wiki
|
|
|
|
[Service]
|
|
Type=simple
|
|
# script(1) gives herdr a real pty. Without it the client reports a 0x0 window and every pane
|
|
# spawn fails with "ghostty error -2" -- which surfaces as a fleetd spawn failure, not a herdr one.
|
|
ExecStart=/usr/bin/script -qfec %h/LTMS/fleetd/fleetd-run/herdr-inner.sh /dev/null
|
|
StandardInput=null
|
|
Environment=TERM=xterm-256color
|
|
Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
|
|
|
|
# PrivateTmp MUST stay false. fleetd writes the member ZDOTDIR scrub dir and the opencode config
|
|
# dir under its own java.io.tmpdir, and the member pane -- a child of THIS process -- has to read
|
|
# them. A private /tmp here silently breaks the credential scrub instead of failing loudly.
|
|
PrivateTmp=false
|
|
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=herdr
|
|
|
|
[Install]
|
|
WantedBy=default.target
|