Omar Sobh
264ee81189
Pilot ran the cluster daemon under nohup; production needs proper restart-on-failure + clean PATH inheritance (rustc gossip probe needs `~/.cargo/bin` on PATH, which nohup's env didn't get). The unit is user-scoped (`~/.config/systemd/user/`) so it works without root on the pilot nodes: cp systemd/clawstor-cluster.service ~/.config/systemd/user/ loginctl enable-linger $USER systemctl --user daemon-reload systemctl --user enable --now clawstor-cluster.service Defaults: - CLAWSTOR_BIN = ~/clawstor-deploy/claw-store - CLAWSTOR_CONFIG = ~/clawstor-deploy/config.toml - PATH prefixed with ~/.cargo/bin so rustc is found Override any of those via `systemctl --user edit clawstor-cluster.service`. Security hardening: - NoNewPrivileges=yes - ProtectSystem=strict (system dirs read-only) - ProtectHome=read-only (home dir read-only) - ReadWritePaths=%h/clawstor-deploy (only the deploy tree is writable) - PrivateTmp=yes Restart semantics: - Restart=on-failure with RestartSec=10 — pilot-verified: kill -9 the daemon PID and the service comes back within ~10s - TimeoutStopSec=60 so a slow gossip departure can complete Deployed to tank + architect 2026-07-12 as part of the pilot retest.
38 lines
1.4 KiB
Desktop File
38 lines
1.4 KiB
Desktop File
[Unit]
|
|
Description=Clawstor cluster daemon (gossip + RPC + Prometheus + build cache)
|
|
Documentation=https://git.redclaw.dev/clawverse/clawstor
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Set both CLAWSTOR_BIN + CLAWSTOR_CONFIG via `systemctl edit
|
|
# clawstor-cluster.service` — the drop-in replaces this unit's
|
|
# ExecStart when the operator wants a non-default install.
|
|
Environment=CLAWSTOR_BIN=%h/clawstor-deploy/claw-store
|
|
Environment=CLAWSTOR_CONFIG=%h/clawstor-deploy/config.toml
|
|
# rustc must be on PATH so the fingerprint gossip probe finds it.
|
|
# `%h/.cargo/bin` is where rustup normally installs it. Adjust via
|
|
# drop-in if your toolchain lives elsewhere.
|
|
Environment=PATH=%h/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
Environment=RUST_LOG=info
|
|
ExecStart=/bin/sh -c '"$CLAWSTOR_BIN" --config "$CLAWSTOR_CONFIG" daemon'
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
# Give the daemon 60s to shut down cleanly (gossip needs to
|
|
# advertise its intent so peers observe departure quickly). Longer
|
|
# than default so a slow gossip round can complete.
|
|
TimeoutStopSec=60
|
|
|
|
# Security hardening — safe defaults for a build-cache daemon:
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=read-only
|
|
# The blob-store root + hot/warm dirs are the only writable paths.
|
|
# Adjust via drop-in when your dirs live outside `%h/clawstor-deploy`.
|
|
ReadWritePaths=%h/clawstor-deploy
|
|
PrivateTmp=yes
|
|
|
|
[Install]
|
|
WantedBy=default.target
|