43 lines
2.2 KiB
Markdown
43 lines
2.2 KiB
Markdown
|
# Milestone 5 — Citizenship
|
||
|
|
|
||
|
|
## What landed
|
||
|
|
|
||
|
|
- **Metered awareness** (`metered` feature, default on): NetworkManager's
|
||
|
|
`Metered` property is polled over D-Bus every 30 s; while metered (or
|
||
|
|
guessed metered) the daemon serves nothing (connections closed at
|
||
|
|
accept) and defers every fetch. Pins stay recorded; mdns
|
||
|
|
re-announcements retrigger auto-sync once unmetered. Builds without
|
||
|
|
D-Bus via `--no-default-features` (always unmetered then).
|
||
|
|
`VARDE_FORCE_METERED=true` forces the state — a manual kill switch and
|
||
|
|
the test hook.
|
||
|
|
- **DSCP CS1** on the endpoint's UDP sockets, best effort. iroh does not
|
||
|
|
expose its socket fds, so we match the endpoint's bound ports against
|
||
|
|
`/proc/net/udp{,6}` inodes and walk `/proc/self/fd` — Linux-only like
|
||
|
|
the daemon itself. Failures are logged at debug and ignored, as the
|
||
|
|
spec allows.
|
||
|
|
- **systemd socket activation**: `LISTEN_FDS` (fd 3) is adopted when
|
||
|
|
present, otherwise the daemon binds its own socket — non-systemd
|
||
|
|
distros work identically. Readiness is signaled with a hand-rolled
|
||
|
|
`sd_notify(READY=1)` (abstract and path sockets), no libsystemd
|
||
|
|
dependency. Activation sockets are not unlinked at shutdown; systemd
|
||
|
|
owns them.
|
||
|
|
- **dist/**: hardened system units (`DynamicUser`, `ProtectSystem=strict`,
|
||
|
|
`StateDirectory`/`RuntimeDirectory`, `NoNewPrivileges`, restricted
|
||
|
|
address families and syscalls), user units, commented example
|
||
|
|
`config.toml`, scdoc man pages (`varde.8`, `varde-ctl.1`, validated
|
||
|
|
with scdoc), and an explicitly untested `PKGBUILD` skeleton for Arch.
|
||
|
|
|
||
|
|
## Decisions
|
||
|
|
|
||
|
|
- **Type=notify + Requires=varde.socket** so systemd tracks readiness
|
||
|
|
precisely and activation works out of the box; the same binary still
|
||
|
|
runs under `ExecStart` alone.
|
||
|
|
- **Metered gating sits at the two choke points** (connection accept,
|
||
|
|
fetch queue) rather than inside the rate limiter, so the posture is
|
||
|
|
binary and auditable: metered ⇒ zero bytes moved, period.
|
||
|
|
- **Polling NM instead of subscribing to PropertiesChanged**: 30 s of
|
||
|
|
staleness is acceptable for a background mirror and the code stays
|
||
|
|
~40 lines with graceful degradation when NM or D-Bus is absent.
|
||
|
|
- `varde-ctl` already had `--json` and human output from milestone 1;
|
||
|
|
the polish here was man-page coverage of every command.
|