bl
871280553e
Metered detection polls NetworkManager's Metered property over D-Bus (feature "metered", default on; builds without D-Bus via no-default-features). While metered the daemon closes incoming blob connections and defers every fetch; VARDE_FORCE_METERED=true forces the state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1 best-effort by matching bound ports to /proc/net/udp inodes (iroh hides its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness is a hand-rolled sd_notify READY=1 (abstract + path sockets), and standalone binding still works unchanged. dist/ ships hardened system and user units (DynamicUser, ProtectSystem=strict, StateDirectory, RestrictAddressFamilies), a commented config example, scdoc man pages validated with scdoc, and an untested PKGBUILD skeleton. Tests: activation-socket round trip via a real fd-3 handoff, READY=1 received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch. Dependencies: zbus (optional, feature-gated D-Bus client for the NetworkManager metered flag). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
78 lines
2.4 KiB
Markdown
78 lines
2.4 KiB
Markdown
varde(8)
|
|
|
|
# NAME
|
|
|
|
varde-daemon - content-addressed blob mirror daemon on iroh
|
|
|
|
# SYNOPSIS
|
|
|
|
*varde-daemon* [_OPTIONS_]
|
|
|
|
# DESCRIPTION
|
|
|
|
varde owns a content-addressed blob store and mirrors content between
|
|
consenting peers. Applications talk to it over a unix socket speaking
|
|
JSON Lines (one request per line, one response per line); *varde-ctl*(1)
|
|
is the reference client.
|
|
|
|
Discovery is open; replication is explicit. The daemon advertises itself
|
|
via mDNS on the local network (identifiable, never camouflaged), but
|
|
content is only served to peers on the trust allowlist, plus content
|
|
deliberately published per-pin (*open-lan*) or via ticket export. All
|
|
fetched data is BLAKE3-verified regardless of source.
|
|
|
|
Default traffic posture: LAN only (no relay), upload capped at 10 MiB/s,
|
|
UDP sockets marked DSCP CS1 (best effort), and all transfers stop while
|
|
NetworkManager reports the connection as metered.
|
|
|
|
# OPTIONS
|
|
|
|
*--config* _PATH_
|
|
Config file. Default: _/etc/varde/config.toml_ in system mode,
|
|
_$XDG_CONFIG_HOME/varde/config.toml_ in user mode. The default file
|
|
may be absent; an explicitly named one must exist.
|
|
|
|
*--store* _PATH_
|
|
Store directory override.
|
|
|
|
*--socket* _PATH_
|
|
API socket path override.
|
|
|
|
*--system*, *--user*
|
|
Force system-mode or user-mode default paths. Default: system when
|
|
running as root, user otherwise.
|
|
|
|
*--version*, *--help*
|
|
Print version or usage and exit.
|
|
|
|
# CONFIGURATION
|
|
|
|
See the commented example at _/etc/varde/config.toml_. Precedence:
|
|
flags > *VARDE_\** environment variables (*VARDE_CONFIG*, *VARDE_STORE*,
|
|
*VARDE_SOCKET*, *VARDE_MAX_UPLOAD*, *VARDE_MAX_DOWNLOAD*,
|
|
*VARDE_DISCOVERY*, *VARDE_WAN_UPLOAD*) > config file > defaults.
|
|
|
|
# FILES
|
|
|
|
_/var/lib/varde_ (system), _$XDG_DATA_HOME/varde_ (user)
|
|
Store directory: iroh-blobs store under _blobs/_, pins and trust in
|
|
_meta.json_, endpoint key in _secret.key_ (mode 0600).
|
|
|
|
_/run/varde/varde.sock_ (system), _$XDG_RUNTIME_DIR/varde.sock_ (user)
|
|
API socket. systemd socket activation (LISTEN_FDS) is supported;
|
|
without it the daemon binds the socket itself.
|
|
|
|
# NOTES
|
|
|
|
Materialization attempts a reflink (FICLONE) before falling back to a
|
|
byte copy; store directory and materialization targets must share a
|
|
filesystem (btrfs/XFS) for reflinks to work. Store files are immutable
|
|
and never hardlinked out.
|
|
|
|
DSCP marking may require CAP_NET_ADMIN on some systems and is silently
|
|
skipped where unavailable.
|
|
|
|
# SEE ALSO
|
|
|
|
*varde-ctl*(1)
|