bl
871280553e
Metered detection polls NetworkManager's Metered property over D-Bus (feature "metered", default on; builds without D-Bus via no-default-features). While metered the daemon closes incoming blob connections and defers every fetch; VARDE_FORCE_METERED=true forces the state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1 best-effort by matching bound ports to /proc/net/udp inodes (iroh hides its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness is a hand-rolled sd_notify READY=1 (abstract + path sockets), and standalone binding still works unchanged. dist/ ships hardened system and user units (DynamicUser, ProtectSystem=strict, StateDirectory, RestrictAddressFamilies), a commented config example, scdoc man pages validated with scdoc, and an untested PKGBUILD skeleton. Tests: activation-socket round trip via a real fd-3 handoff, READY=1 received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch. Dependencies: zbus (optional, feature-gated D-Bus client for the NetworkManager metered flag). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
43 lines
2.2 KiB
Markdown
43 lines
2.2 KiB
Markdown
# Milestone 5 — Citizenship
|
|
|
|
## What landed
|
|
|
|
- **Metered awareness** (`metered` feature, default on): NetworkManager's
|
|
`Metered` property is polled over D-Bus every 30 s; while metered (or
|
|
guessed metered) the daemon serves nothing (connections closed at
|
|
accept) and defers every fetch. Pins stay recorded; mdns
|
|
re-announcements retrigger auto-sync once unmetered. Builds without
|
|
D-Bus via `--no-default-features` (always unmetered then).
|
|
`VARDE_FORCE_METERED=true` forces the state — a manual kill switch and
|
|
the test hook.
|
|
- **DSCP CS1** on the endpoint's UDP sockets, best effort. iroh does not
|
|
expose its socket fds, so we match the endpoint's bound ports against
|
|
`/proc/net/udp{,6}` inodes and walk `/proc/self/fd` — Linux-only like
|
|
the daemon itself. Failures are logged at debug and ignored, as the
|
|
spec allows.
|
|
- **systemd socket activation**: `LISTEN_FDS` (fd 3) is adopted when
|
|
present, otherwise the daemon binds its own socket — non-systemd
|
|
distros work identically. Readiness is signaled with a hand-rolled
|
|
`sd_notify(READY=1)` (abstract and path sockets), no libsystemd
|
|
dependency. Activation sockets are not unlinked at shutdown; systemd
|
|
owns them.
|
|
- **dist/**: hardened system units (`DynamicUser`, `ProtectSystem=strict`,
|
|
`StateDirectory`/`RuntimeDirectory`, `NoNewPrivileges`, restricted
|
|
address families and syscalls), user units, commented example
|
|
`config.toml`, scdoc man pages (`varde.8`, `varde-ctl.1`, validated
|
|
with scdoc), and an explicitly untested `PKGBUILD` skeleton for Arch.
|
|
|
|
## Decisions
|
|
|
|
- **Type=notify + Requires=varde.socket** so systemd tracks readiness
|
|
precisely and activation works out of the box; the same binary still
|
|
runs under `ExecStart` alone.
|
|
- **Metered gating sits at the two choke points** (connection accept,
|
|
fetch queue) rather than inside the rate limiter, so the posture is
|
|
binary and auditable: metered ⇒ zero bytes moved, period.
|
|
- **Polling NM instead of subscribing to PropertiesChanged**: 30 s of
|
|
staleness is acceptable for a background mirror and the code stays
|
|
~40 lines with graceful degradation when NM or D-Bus is absent.
|
|
- `varde-ctl` already had `--json` and human output from milestone 1;
|
|
the polish here was man-page coverage of every command.
|