4f6159d961
AUR installs never call `numa install` — PKGBUILD drops the unit straight into /usr/lib/systemd/system and the user runs `systemctl enable numa`. With User=numa the Rust installer's useradd code never fires there, breaking Arch out of the box. DynamicUser=yes sidesteps packaging entirely — systemd allocates a transient UID per start and remaps StateDirectory ownership (including legacy root-owned trees) automatically. Works on any modern systemd. Drops the ensure_numa_user_linux/chown helpers plus NUMA_USER; the unit file alone now captures the privilege-drop story.
47 lines
1.2 KiB
Desktop File
47 lines
1.2 KiB
Desktop File
[Unit]
|
|
Description=Numa DNS — DNS you own, everywhere you go
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart={{exe_path}}
|
|
Restart=always
|
|
RestartSec=2
|
|
|
|
# Transient system user per start; no PKGBUILD/sysusers setup required.
|
|
# systemd remaps the StateDirectory ownership to the dynamic UID on each
|
|
# launch, including legacy root-owned trees from pre-drop installs.
|
|
DynamicUser=yes
|
|
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
|
|
StateDirectory=numa
|
|
StateDirectoryMode=0750
|
|
ConfigurationDirectory=numa
|
|
ConfigurationDirectoryMode=0755
|
|
|
|
# Sandboxing — conservative set known to work with Rust network daemons.
|
|
# Aggressive hardening (MemoryDenyWriteExecute, SystemCallFilter, seccomp
|
|
# allow-lists) can be layered on once tested in isolation.
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
# AF_NETLINK for interface enumeration on network changes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=numa
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|