Omar SobhandClaude Sonnet 4.6
70d1d410bb
ProtectSystem=strict in claw-store-serve.service only listed
/var/lib/claw-store as writable. The serve process shells out to
`claw-store activate/deactivate` which also needs to write to:
/hot/targets — create/remove hot target dirs
/slab/projects — write/remove .cargo/config.toml
Subprocess inherits the service's mount namespace, so both paths were
silently read-only, causing activate/deactivate from the dashboard to
return {"ok":false,"error":"Read-only file system (os error 30)"} while
the same commands worked fine from a login shell.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
37 lines
1.4 KiB
Desktop File
37 lines
1.4 KiB
Desktop File
[Unit]
|
|
# v0.2.0 — the HTTP+SSE API + React dashboard. Until now this ran as a
|
|
# hand-launched `claw-store serve` from a login shell — survived if the
|
|
# shell exited (orphaned to init), died on reboot. This unit makes the
|
|
# dashboard a first-class service that comes back the same way the
|
|
# daemon does.
|
|
Description=claw-store HTTP API + dashboard
|
|
After=network-online.target claw-store.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=osobh
|
|
ExecStart=/usr/local/bin/claw-store serve --port 7700 --static-dir /usr/share/claw-store/static
|
|
Restart=on-failure
|
|
RestartSec=15
|
|
Environment=RUST_LOG=info
|
|
|
|
# Dashboard is read-mostly + shells out to the local CLI for mutations
|
|
# AND probes the peer over SSH for /api/status's peer_reachable bit.
|
|
# Notes on the sandboxing:
|
|
# - ProtectHome was tried (with BindReadOnlyPaths=/home/osobh/.ssh)
|
|
# but systemd blocks ALL of /home before binds run; the ssh probe
|
|
# hits "Permission denied" on ~/.ssh/known_hosts even with the
|
|
# bind. Re-introduce via ProtectHome=tmpfs + an explicit bind if
|
|
# stronger sandboxing is needed later.
|
|
ProtectSystem=strict
|
|
# /var/lib/claw-store — manifest, sync queue, daemon-started file
|
|
# /hot/targets — activate/deactivate create/remove hot target dirs
|
|
# /slab/projects — activate/deactivate write/remove .cargo/config.toml
|
|
ReadWritePaths=/var/lib/claw-store /hot/targets /slab/projects
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|