Repository navigation
fix: copy the keystore credential to a 0600 runtime file in sponsord.service - #37
Merged
Merged
Conversation
…service systemd 255 loads LoadCredential= files at 0440, and decdn's keystore check refuses any group or other bit, so the reference unit crash-looped on Ubuntu 24.04. Copy the keystore into a private RuntimeDirectory at 0600 in ExecStartPre and point SPONSORD_TREASURY_KEYSTORE there. The copy is still the encrypted keystore; the password stays in %d. Closes #36 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The unit change directly addresses #36 and is consistently documented.
Review effort: Balanced
Findings: None
What changed in this PR
Fixes sponsord startup failures on systemd 255 by creating a private 0600 runtime copy of the keystore credential.
Changes:
- Adds the runtime keystore copy to the systemd unit.
- Documents the workaround.
- Records the fix in the changelog.
| File | Description |
|---|---|
deploy/systemd/sponsord.service |
Creates and uses the private runtime keystore. |
docs/operator.md |
Documents systemd credential handling. |
crates/sponsord/CHANGELOG.md |
Records the systemd 255 fix. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
… docs The 0440 mode comes from systemd 254+ on Linux 6.4+, where credentials live on tmpfs and access is granted through an ACL whose mask shows in the group bits; it is not systemd 255 specifically, nor literally group-readable. Say "some systemd versions (254+ on Linux 6.4+, seen on 255)", note that /run/sponsord is removed on stop, and tell operators with an installed copy of the unit which lines to take. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
On systemd 255 (Ubuntu 24.04),
LoadCredential=files land at mode0440. The reference unit pointedSPONSORD_TREASURY_KEYSTOREstraight at%d/treasury-keystore.json. decdn'svalidate_keystore_filerefuses any group or other bit, so the daemon crash-looped. systemd 252 uses0400, so Debian 12 was not affected.The unit now copies the keystore credential to
%t/sponsord/treasury-keystore.jsonat0600inExecStartPre, inside a0700RuntimeDirectory=, and points the daemon at the copy. The decdn/devops Ansible role already does the same (decdn/devops#82).Closes #36
Reviewer notes
%d.ExecStartPreruns as the sameDynamicUser, so the copy is owned by the service user.RuntimeDirectory=is writable underProtectSystem=strict, and it is removed when the service stops.api-tokenandtreasury-passwordstay in%d, because sponsord does not check their file modes.sponsord-onramp.serviceloads no keystore and is unchanged.$CREDENTIALS_DIRECTORYwould mean a change in decdn.Verification
systemd-analyze verify deploy/systemd/sponsord.serviceon systemd 255 (255.4-1ubuntu8.17): the unit parses. The only warning is that/usr/local/bin/sponsordis not installed on this host.markdownlint-cli2on the changed Markdown: 0 issues.The issue reporter verified the same unit snippet on systemd 252 and 255 with the real binary. It gets past credential loading, the permission check and decryption. I did not re-run that here.
No Rust changes, so the cargo items do not apply.
User-visible change: entry in the changed crate's
crates/<dir>/CHANGELOG.mdPR title uses a type the
pr-titlecheck allows🤖 Generated with Claude Code