Download this file
| 1 | [Service] |
| 2 | # Optional drop-in: apply ONLY on a box that already runs controld AND opts |
| 3 | # into the activator mesh (docs/planet-scale.md, mesh.go). Grants the router |
| 4 | # read-only access to the control token via systemd's LoadCredential — not a |
| 5 | # filesystem write grant. Without it, a mesh-replicated route (one that only |
| 6 | # ever gets a registry row on this box, never a live symlink — see |
| 7 | # meshreplicate.go) fails its first wake here: staging its binary needs a |
| 8 | # write to /opt/lchat, which this unit's own ProtectSystem=strict sandbox |
| 9 | # refuses, and only controld's always-unsandboxed root process can do (see |
| 10 | # activator.go's s3Backend.materialize, controld.go's materializeHandler). |
| 11 | # |
| 12 | # Apply: |
| 13 | # cp deploy/systemd/lchat-router-control-token.conf \ |
| 14 | # /etc/systemd/system/lchat-router.service.d/control-token.conf |
| 15 | # systemctl daemon-reload && systemctl restart lchat-router |
| 16 | # |
| 17 | # Requires /etc/lchat/control.token to already exist (controld already set |
| 18 | # up first) — LoadCredential fails the WHOLE unit to start if its source path |
| 19 | # is missing, so do not apply this on a box that doesn't run controld. |
| 20 | LoadCredential=control-token:/etc/lchat/control.token |
| 21 | |
amadan