Omar SobhandClaude Sonnet 4.6
7902c2e395
Build with clawstor cache / Cargo build (clawstor-cached) (push) Failing after 10m3s
- All three node configs (architect/tank/morpheus) now include [cluster]
section with correct 10G fabric IPs, mTLS TLS paths, and blob store root.
Architect binds gossip on 10.0.0.13:7701 and RPC on 10.10.0.9:7702 (10G
to Tank); Morpheus uses LAN 10.0.0.5 (no direct 10G).
- claw-store.service: updated description, adds clawstor-deploy to
ReadWritePaths, removes NoNewPrivileges (needed for sudo zfs snapshot).
- claw-store-serve.service: adds --v2-static-dir /usr/share/claw-store/v2
so the aggregator serves dashboard-v2 ("clawstor · command center") at /v2/.
- claw-fuse.service: new unit, uses correct --data-dir + --mount flags.
Deployed to Architect, Tank, Morpheus. Fleet CA re-initialized; new certs
signed for all three nodes and distributed. Dashboard accessible at
http://100.104.171.32:7700/v2/ aggregating Tank + Morpheus via /api/v2/fleet.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
37 lines
1.5 KiB
Desktop File
37 lines
1.5 KiB
Desktop File
[Unit]
|
|
# v0.2.0 — the HTTP+SSE API + React dashboard. Until now this ran as a
|
|
# hand-launched `claw-store serve` from a login shell — survived if the
|
|
# shell exited (orphaned to init), died on reboot. This unit makes the
|
|
# dashboard a first-class service that comes back the same way the
|
|
# daemon does.
|
|
Description=claw-store HTTP API + dashboard
|
|
After=network-online.target claw-store.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=osobh
|
|
ExecStart=/usr/local/bin/claw-store serve --port 7700 --static-dir /usr/share/claw-store/static --v2-static-dir /usr/share/claw-store/v2
|
|
Restart=on-failure
|
|
RestartSec=15
|
|
Environment=RUST_LOG=info
|
|
|
|
# Dashboard is read-mostly + shells out to the local CLI for mutations
|
|
# AND probes the peer over SSH for /api/status's peer_reachable bit.
|
|
# Notes on the sandboxing:
|
|
# - ProtectHome was tried (with BindReadOnlyPaths=/home/osobh/.ssh)
|
|
# but systemd blocks ALL of /home before binds run; the ssh probe
|
|
# hits "Permission denied" on ~/.ssh/known_hosts even with the
|
|
# bind. Re-introduce via ProtectHome=tmpfs + an explicit bind if
|
|
# stronger sandboxing is needed later.
|
|
ProtectSystem=strict
|
|
# /var/lib/claw-store — manifest, sync queue, daemon-started file
|
|
# /hot/targets — activate/deactivate create/remove hot target dirs
|
|
# /slab/projects — activate/deactivate write/remove .cargo/config.toml
|
|
ReadWritePaths=/var/lib/claw-store /hot/targets /slab/projects
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|