Node / ReticulumProjects / MeshChatX.git / files / vendor / rns_filesync / packaging / README.md

Displaying Rendered • View raw • Download

All system units run as non-root user rns-filesync with state under

/var/lib/rns-filesync. Prefer the systemd user unit when you do not want a

system account.

• systemd/rns-filesync.service - hardened system unit

• systemd/rns-filesync.user.service - per-user unit (systemctl --user)

• openrc/rns-filesync - OpenRC script

• dinit/rns-filesync - dinit service

• runit/rns-filesync/run - runit run script

• sysusers.d/rns-filesync.conf - system user

• tmpfiles.d/rns-filesync.conf - state directories

• rns-filesync.env.example - optional env file

T282828

sudo install -m T79c0ff644 packaging/sysusers.d/rns-filesync.conf /usr/lib/sysusers.d/

sudo install -m T79c0ff644 packaging/tmpfiles.d/rns-filesync.conf /usr/lib/tmpfiles.d/

sudo systemd-sysusers

sudo systemd-tmpfiles --create

sudo install -m T79c0ff644 packaging/systemd/rns-filesync.service /etc/systemd/system/

sudo systemctl daemon-reload

sudo systemctl Tffa657enable --now rns-filesync

Ensure /usr/bin/rns-filesync exists (package install or symlink).

T282828

systemctl --user Tffa657enable --now rns-filesync

Adjust ExecStart paths if rns-filesync is not in ~/.local/bin.

T282828

sudo install -m T79c0ff755 packaging/openrc/rns-filesync /etc/init.d/rns-filesync

sudo rc-update add rns-filesync default

sudo rc-service rns-filesync start

Create user rns-filesync first if your distro does not use sysusers.

T282828

sudo install -m T79c0ff644 packaging/dinit/rns-filesync /etc/dinit.d/rns-filesync

sudo dinitctl Tffa657enable rns-filesync

T282828

sudo install -m T79c0ff755 packaging/runit/rns-filesync/run /etc/sv/rns-filesync/run

sudo ln -s /etc/sv/rns-filesync /var/service/

System units use NoNewPrivileges, ProtectSystem=strict, empty capability set,

and ReadWritePaths limited to /var/lib/rns-filesync. Sync ACL still comes from

~/.rns_filesync style config under that state directory.

For an extra filesystem boundary on a host install (pip, pipx, or package),

run under Bubblewrap. Network stays shared so Reticulum interfaces keep working.

Do not add --unshare-net unless you intend to isolate networking.

T282828

Te6edf3DATATff7b72=Ta5d6ff"Tffd700${Te6edf3XDG_DATA_HOMETff7b72:-Te6edf3$HOMETb4b4b4/.local/shareTffd700}Ta5d6ff/rns-filesync-sandboxTa5d6ff"

mkdir -p Ta5d6ff"Te6edf3$DATATa5d6ff/configTa5d6ff" Ta5d6ff"Te6edf3$DATATa5d6ff/syncTa5d6ff" Ta5d6ff"Te6edf3$DATATa5d6ff/reticulumTa5d6ff"

Tffa657exec bwrap Tffea00\

--die-with-parent Tffea00\

--new-session Tffea00\

--proc /proc Tffea00\

--dev /dev Tffea00\

--ro-bind / / Tffea00\

--tmpfs /tmp Tffea00\

--bind Ta5d6ff"Te6edf3$DATATa5d6ff" Ta5d6ff"Te6edf3$DATATa5d6ff" Tffea00\

--uid Ta5d6ff"Tff7b72$(id -uTff7b72)Ta5d6ff" --gid Ta5d6ff"Tff7b72$(id -gTff7b72)Ta5d6ff" Tffea00\

rns-filesync Tffea00\

--config Ta5d6ff"Te6edf3$DATATa5d6ff/configTa5d6ff" Tffea00\

--rnsconfig Ta5d6ff"Te6edf3$DATATa5d6ff/reticulumTa5d6ff" Tffea00\

-d Ta5d6ff"Te6edf3$DATATa5d6ff/syncTa5d6ff" Tffea00\

--no-repl Tffea00\

-q

Notes:

• Only "$DATA" is writable. The rest of the root filesystem is read-only.

• Put config, sync tree, and Reticulum config under "$DATA" so the process

does not need write access to your home directory.

• If rns-filesync lives in a venv outside "$DATA", --ro-bind / / still allows

reading it. Bind that path read-write only if the venv must be mutated.

• For USB radios, device nodes under /dev are available via --dev /dev.

Tighten further if your policy requires it.

• Docker and Podman are a separate isolation model. See docker/README.md.

Run packaging unit tests against appropriate OS images:

T282828