ae12ff2517
v1.7.104 shipped ISOs whose units crash-looped (nostr-relay 3s loop, archipelago-diag 203/EXEC) because build-time extraction failures were mere warnings and the cached rootfs never tracked its recipe: - hash the rootfs-defining region of the build script and rebuild when it changes (stale cache shipped ISOs without wpasupplicant/iw/rfkill) - refuse to build without nvpn / nostr-rs-relay unless ALLOW_MISSING_VPN_BINARIES=1 - ConditionPathExists on nostr-relay/nostr-vpn/diag units so a stripped image skips them instead of crash-looping - post-install test: every enabled archipelago*/nostr* unit must have an existing ExecStart payload Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
36 lines
1.0 KiB
Desktop File
36 lines
1.0 KiB
Desktop File
[Unit]
|
|
Description=Nostr VPN - Mesh VPN with Nostr identity
|
|
After=network-online.target tor.service archipelago.service
|
|
Wants=network-online.target
|
|
StartLimitIntervalSec=300
|
|
StartLimitBurst=10
|
|
# An ISO built without the nvpn binary (registry unreachable at build time)
|
|
# must not restart-loop — skip cleanly instead.
|
|
ConditionPathExists=/usr/local/bin/nvpn
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
Environment=HOME=/var/lib/archipelago/nostr-vpn
|
|
EnvironmentFile=-/var/lib/archipelago/nostr-vpn/env
|
|
ExecStartPre=+/bin/bash -c 'mkdir -p /run/nostr-vpn /var/lib/archipelago/nostr-vpn/.config/nvpn'
|
|
ExecStartPre=/bin/bash -c 'test -f /var/lib/archipelago/nostr-vpn/env || { echo "NostrVPN not configured — waiting for onboarding"; exit 1; }'
|
|
ExecStart=/usr/local/bin/nvpn daemon
|
|
Restart=on-failure
|
|
RestartSec=30
|
|
TimeoutStartSec=30
|
|
TimeoutStopSec=10
|
|
|
|
# No sandbox — runs as root for TUN/WireGuard, needs unrestricted filesystem
|
|
|
|
# Resource limits
|
|
MemoryMax=256M
|
|
TasksMax=64
|
|
|
|
# Logging
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|