Omar Sobh
9fe6bf4772
Follow-up to PR #28. Fresh Pi deploy 2026-07-12 hit a `ProtectHome= read-only` block on the daemon's XDG-driven $HOME/.local/state/claw-store/projects.toml write. Adding the path to `ReadWritePaths` in the shipped unit means future deployers don't need a drop-in.
41 lines
1.6 KiB
Desktop File
41 lines
1.6 KiB
Desktop File
[Unit]
|
|
Description=Clawstor cluster daemon (gossip + RPC + Prometheus + build cache)
|
|
Documentation=https://git.redclaw.dev/clawverse/clawstor
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Set both CLAWSTOR_BIN + CLAWSTOR_CONFIG via `systemctl edit
|
|
# clawstor-cluster.service` — the drop-in replaces this unit's
|
|
# ExecStart when the operator wants a non-default install.
|
|
Environment=CLAWSTOR_BIN=%h/clawstor-deploy/claw-store
|
|
Environment=CLAWSTOR_CONFIG=%h/clawstor-deploy/config.toml
|
|
# rustc must be on PATH so the fingerprint gossip probe finds it.
|
|
# `%h/.cargo/bin` is where rustup normally installs it. Adjust via
|
|
# drop-in if your toolchain lives elsewhere.
|
|
Environment=PATH=%h/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
Environment=RUST_LOG=info
|
|
ExecStart=/bin/sh -c '"$CLAWSTOR_BIN" --config "$CLAWSTOR_CONFIG" daemon'
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
# Give the daemon 60s to shut down cleanly (gossip needs to
|
|
# advertise its intent so peers observe departure quickly). Longer
|
|
# than default so a slow gossip round can complete.
|
|
TimeoutStopSec=60
|
|
|
|
# Security hardening — safe defaults for a build-cache daemon:
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=read-only
|
|
# The blob-store root + hot/warm dirs are the only writable paths.
|
|
# Adjust via drop-in when your dirs live outside `%h/clawstor-deploy`.
|
|
# v1 daemon still writes projects.toml + related state under XDG.
|
|
# %h/.local/state/claw-store is created on first run; the systemd
|
|
# unit needs to whitelist it under ProtectHome=read-only.
|
|
ReadWritePaths=%h/clawstor-deploy %h/.local/state/claw-store
|
|
PrivateTmp=yes
|
|
|
|
[Install]
|
|
WantedBy=default.target
|