mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
8fd515e81f
Installing /etc/fips/fips.yaml as a live dpkg conf-file collides with a configuration-management-rendered or operator-edited config on upgrade: dpkg either prompts interactively (keep/replace), stalling unattended upgrades, or clobbers the local file. Ship the default config as /usr/share/doc/fips/fips.yaml.example (mode 644) and drop it from conf-files. postinst now seeds /etc/fips/fips.yaml from the example only when it does not already exist (mode 600), yielding to any existing config without a prompt or clobber. Add ConditionPathExists for the config to the service unit so a missing config skips the unit cleanly rather than crash-looping.
30 lines
763 B
Desktop File
30 lines
763 B
Desktop File
[Unit]
|
|
Description=FIPS Mesh Network Daemon
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
# The config file is no longer a packaged conf-file; postinst seeds it
|
|
# if absent. Skip the unit (inactive, not failed) rather than crash-loop
|
|
# if it is ever missing.
|
|
ConditionPathExists=/etc/fips/fips.yaml
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/fips --config /etc/fips/fips.yaml
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Control socket directory (/run/fips/).
|
|
# Group-accessible so 'fips' group members can use fipsctl/fipstop.
|
|
RuntimeDirectory=fips
|
|
RuntimeDirectoryMode=0750
|
|
|
|
# Security hardening (daemon runs as root for TUN and raw sockets)
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=no
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|