bl
871280553e
Metered detection polls NetworkManager's Metered property over D-Bus (feature "metered", default on; builds without D-Bus via no-default-features). While metered the daemon closes incoming blob connections and defers every fetch; VARDE_FORCE_METERED=true forces the state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1 best-effort by matching bound ports to /proc/net/udp inodes (iroh hides its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness is a hand-rolled sd_notify READY=1 (abstract + path sockets), and standalone binding still works unchanged. dist/ ships hardened system and user units (DynamicUser, ProtectSystem=strict, StateDirectory, RestrictAddressFamilies), a commented config example, scdoc man pages validated with scdoc, and an untested PKGBUILD skeleton. Tests: activation-socket round trip via a real fd-3 handoff, READY=1 received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch. Dependencies: zbus (optional, feature-gated D-Bus client for the NetworkManager metered flag). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
29 lines
1.1 KiB
TOML
29 lines
1.1 KiB
TOML
# varde example configuration — /etc/varde/config.toml (system) or
|
|
# $XDG_CONFIG_HOME/varde/config.toml (user).
|
|
#
|
|
# Every key is optional; the daemon runs with an empty (or absent)
|
|
# config. Values shown are the defaults. Precedence:
|
|
# CLI flags > VARDE_* environment > this file > defaults.
|
|
|
|
# Directory holding the blob store, metadata and endpoint secret key.
|
|
# Default: /var/lib/varde (system) or $XDG_DATA_HOME/varde (user).
|
|
#store_dir = "/var/lib/varde"
|
|
|
|
# Unix socket serving the JSON-lines API.
|
|
# Default: /run/varde/varde.sock (system) or $XDG_RUNTIME_DIR/varde.sock.
|
|
#socket_path = "/run/varde/varde.sock"
|
|
|
|
# Upload cap in bytes/sec. 0 disables serving entirely.
|
|
#max_upload_bytes_per_sec = 10485760 # 10 MiB/s
|
|
|
|
# Download cap in bytes/sec. 0 means unlimited.
|
|
#max_download_bytes_per_sec = 0
|
|
|
|
# LAN peer discovery (mDNS). Discovery is the open tier: being visible
|
|
# costs nothing; serving is still gated on trust and per-pin policy.
|
|
#discovery = true
|
|
|
|
# Permit WAN traffic (enables the iroh relay for NAT traversal). Off by
|
|
# default: LAN-only posture, zero WAN upload.
|
|
#wan_upload = false
|