From b475faba2ae0d43431de0fb418706d1329395fcd Mon Sep 17 00:00:00 2001 From: fy59 Date: Fri, 25 Sep 2026 05:42:29 +0200 Subject: [PATCH] fix(systemd): track canonical user units --- .../systemd/user/arch-sentinel-sample.service | 16 +++++++++ .../systemd/user/arch-sentinel-sample.timer | 11 ++++++ .../default.target.wants/trainlog-btd.service | 1 + .../trainlog-syncd.service | 1 + .../default.target.wants/trainlog-web.service | 1 + .../systemd/user/gnome-keyring.service | 11 ------ .../keyring.service | 1 - systemd/.config/systemd/user/keyring.service | 11 ------ .../systemd/user/lardon-freecad.service | 16 +++++++++ .../arch-sentinel-sample.timer | 1 + .../.config/systemd/user/trainlog-btd.service | 13 +++++++ .../systemd/user/trainlog-syncd.service | 13 +++++++ .../full-generation.conf | 2 ++ .../.config/systemd/user/trainlog-web.service | 35 +++++++++++++++++++ .../sync-generation.conf | 2 ++ 15 files changed, 112 insertions(+), 23 deletions(-) create mode 100644 systemd/.config/systemd/user/arch-sentinel-sample.service create mode 100644 systemd/.config/systemd/user/arch-sentinel-sample.timer create mode 120000 systemd/.config/systemd/user/default.target.wants/trainlog-btd.service create mode 120000 systemd/.config/systemd/user/default.target.wants/trainlog-syncd.service create mode 120000 systemd/.config/systemd/user/default.target.wants/trainlog-web.service delete mode 100644 systemd/.config/systemd/user/gnome-keyring.service delete mode 120000 systemd/.config/systemd/user/graphical-session.target.wants/keyring.service delete mode 100644 systemd/.config/systemd/user/keyring.service create mode 100644 systemd/.config/systemd/user/lardon-freecad.service create mode 120000 systemd/.config/systemd/user/timers.target.wants/arch-sentinel-sample.timer create mode 100644 systemd/.config/systemd/user/trainlog-btd.service create mode 100644 systemd/.config/systemd/user/trainlog-syncd.service create mode 100644 systemd/.config/systemd/user/trainlog-syncd.service.d/full-generation.conf create mode 100644 systemd/.config/systemd/user/trainlog-web.service create mode 100644 systemd/.config/systemd/user/trainlog-web.service.d/sync-generation.conf diff --git a/systemd/.config/systemd/user/arch-sentinel-sample.service b/systemd/.config/systemd/user/arch-sentinel-sample.service new file mode 100644 index 000000000..3dea61018 --- /dev/null +++ b/systemd/.config/systemd/user/arch-sentinel-sample.service @@ -0,0 +1,16 @@ +[Unit] +Description=Arch Sentinel - collecte légère + +[Service] +Type=oneshot +ExecStart=%h/.local/bin/arch-sentinel sample +Nice=10 +IOSchedulingClass=idle +NoNewPrivileges=yes +PrivateTmp=yes +ProtectSystem=strict +ProtectHome=read-only +ReadWritePaths=%h/.local/share/arch-sentinel +RestrictAddressFamilies=AF_UNIX +LockPersonality=yes +MemoryDenyWriteExecute=yes diff --git a/systemd/.config/systemd/user/arch-sentinel-sample.timer b/systemd/.config/systemd/user/arch-sentinel-sample.timer new file mode 100644 index 000000000..438cda780 --- /dev/null +++ b/systemd/.config/systemd/user/arch-sentinel-sample.timer @@ -0,0 +1,11 @@ +[Unit] +Description=Arch Sentinel - relevé périodique + +[Timer] +OnBootSec=2min +OnUnitActiveSec=5min +AccuracySec=30s +Persistent=true + +[Install] +WantedBy=timers.target diff --git a/systemd/.config/systemd/user/default.target.wants/trainlog-btd.service b/systemd/.config/systemd/user/default.target.wants/trainlog-btd.service new file mode 120000 index 000000000..6b0517628 --- /dev/null +++ b/systemd/.config/systemd/user/default.target.wants/trainlog-btd.service @@ -0,0 +1 @@ +/home/fy59/.config/systemd/user/trainlog-btd.service \ No newline at end of file diff --git a/systemd/.config/systemd/user/default.target.wants/trainlog-syncd.service b/systemd/.config/systemd/user/default.target.wants/trainlog-syncd.service new file mode 120000 index 000000000..264f0e899 --- /dev/null +++ b/systemd/.config/systemd/user/default.target.wants/trainlog-syncd.service @@ -0,0 +1 @@ +/home/fy59/.config/systemd/user/trainlog-syncd.service \ No newline at end of file diff --git a/systemd/.config/systemd/user/default.target.wants/trainlog-web.service b/systemd/.config/systemd/user/default.target.wants/trainlog-web.service new file mode 120000 index 000000000..ce83cfac8 --- /dev/null +++ b/systemd/.config/systemd/user/default.target.wants/trainlog-web.service @@ -0,0 +1 @@ +../trainlog-web.service \ No newline at end of file diff --git a/systemd/.config/systemd/user/gnome-keyring.service b/systemd/.config/systemd/user/gnome-keyring.service deleted file mode 100644 index 10517bd90..000000000 --- a/systemd/.config/systemd/user/gnome-keyring.service +++ /dev/null @@ -1,11 +0,0 @@ -[Unit] -Description=GNOME keyring daemon -PartOf=graphical-session.target -After=graphical-session.target - -[Service] -ExecStart=/usr/bin/gnome-keyring-daemon --components=pkcs11,secrets,ssh --start -Restart=on-failure - -[Install] -WantedBy=graphical-session.target diff --git a/systemd/.config/systemd/user/graphical-session.target.wants/keyring.service b/systemd/.config/systemd/user/graphical-session.target.wants/keyring.service deleted file mode 120000 index 36fbe51a6..000000000 --- a/systemd/.config/systemd/user/graphical-session.target.wants/keyring.service +++ /dev/null @@ -1 +0,0 @@ -/home/fy59/.config/systemd/user/keyring.service \ No newline at end of file diff --git a/systemd/.config/systemd/user/keyring.service b/systemd/.config/systemd/user/keyring.service deleted file mode 100644 index bf803d36a..000000000 --- a/systemd/.config/systemd/user/keyring.service +++ /dev/null @@ -1,11 +0,0 @@ -[Unit] -Description=Wayland color temperature (wlsunset) -PartOf=graphical-session.target -After=graphical-session.target - -[Service] -ExecStart=/usr/bin/gnome-keyring-daemon --components=pkcs11,secrets,ssh --start -Restart=on-failure - -[Install] -WantedBy=graphical-session.target diff --git a/systemd/.config/systemd/user/lardon-freecad.service b/systemd/.config/systemd/user/lardon-freecad.service new file mode 100644 index 000000000..e522ab654 --- /dev/null +++ b/systemd/.config/systemd/user/lardon-freecad.service @@ -0,0 +1,16 @@ +[Unit] +Description=Session FreeCAD Lardon avec autopush +Documentation=file://%h/Documents/Lardon/README.md + +ConditionPathExists=%h/Documents/Lardon/FreeCAD/Lardon_Master.FCStd +ConditionFileIsExecutable=%h/Documents/Lardon/tools/freecad-autopush +ConditionFileIsExecutable=%h/Documents/Lardon/tools/lardon-freecad-session + +[Service] +Type=exec +WorkingDirectory=%h/Documents/Lardon +ExecStart=%h/Documents/Lardon/tools/lardon-freecad-session + +KillMode=control-group +TimeoutStopSec=15s +Restart=no diff --git a/systemd/.config/systemd/user/timers.target.wants/arch-sentinel-sample.timer b/systemd/.config/systemd/user/timers.target.wants/arch-sentinel-sample.timer new file mode 120000 index 000000000..c789d0787 --- /dev/null +++ b/systemd/.config/systemd/user/timers.target.wants/arch-sentinel-sample.timer @@ -0,0 +1 @@ +../arch-sentinel-sample.timer \ No newline at end of file diff --git a/systemd/.config/systemd/user/trainlog-btd.service b/systemd/.config/systemd/user/trainlog-btd.service new file mode 100644 index 000000000..cef6b0fd4 --- /dev/null +++ b/systemd/.config/systemd/user/trainlog-btd.service @@ -0,0 +1,13 @@ +[Unit] +Description=Trainlog Bluetooth RFCOMM agent +ConditionPathExists=/home/fy59/.config/trainlog/sync-generation-config-v1.json + +[Service] +Type=simple +ExecCondition=/usr/bin/grep -Eq '"bluetooth_enabled"[[:space:]]*:[[:space:]]*true' "/home/fy59/.config/trainlog/sync-generation-config-v1.json" +ExecStart=/usr/bin/python3 "/home/fy59/Documents/trainlog/tools/trainlog_bt_agent.py" --config "/home/fy59/.config/trainlog/sync-generation-config-v1.json" +Restart=on-failure +RestartSec=2 + +[Install] +WantedBy=default.target diff --git a/systemd/.config/systemd/user/trainlog-syncd.service b/systemd/.config/systemd/user/trainlog-syncd.service new file mode 100644 index 000000000..3d96a0a16 --- /dev/null +++ b/systemd/.config/systemd/user/trainlog-syncd.service @@ -0,0 +1,13 @@ +[Unit] +Description=Trainlog automatic synchronization agent + +[Service] +Type=simple +Environment=TRAINLOG_SYNC_BT_ADAPTER=/home/fy59/Documents/trainlog/tools/trainlog_generation_bt_adapter.py +Environment=TRAINLOG_SYNC_MTP_ADAPTER=/home/fy59/Documents/trainlog/build/tui/trainlog-generation-mtp-adapter +ExecStart=/usr/bin/python3 "/home/fy59/Documents/trainlog/tools/trainlog_syncd.py" --sync-once "/home/fy59/Documents/trainlog/build/tui/trainlog-sync-once" --bt-adapter "/home/fy59/Documents/trainlog/tools/trainlog_generation_bt_adapter.py" --mtp-adapter "/home/fy59/Documents/trainlog/build/tui/trainlog-generation-mtp-adapter" --interval 3 +Restart=on-failure +RestartSec=2 + +[Install] +WantedBy=default.target diff --git a/systemd/.config/systemd/user/trainlog-syncd.service.d/full-generation.conf b/systemd/.config/systemd/user/trainlog-syncd.service.d/full-generation.conf new file mode 100644 index 000000000..a53fafcf0 --- /dev/null +++ b/systemd/.config/systemd/user/trainlog-syncd.service.d/full-generation.conf @@ -0,0 +1,2 @@ +[Service] +Environment=TRAINLOG_SYNC_GENERATION_CONFIG=/home/fy59/.config/trainlog/sync-generation-config-v1.json diff --git a/systemd/.config/systemd/user/trainlog-web.service b/systemd/.config/systemd/user/trainlog-web.service new file mode 100644 index 000000000..2acf3dc54 --- /dev/null +++ b/systemd/.config/systemd/user/trainlog-web.service @@ -0,0 +1,35 @@ +[Unit] +Description=Trainlog Web local user service +Documentation=https://github.com/labfytools/trainlog +After=default.target +# WHY: A persistent bind failure (notably an occupied 127.0.0.1:8080) must not +# become an aggressive restart loop in the user's session. +StartLimitIntervalSec=60 +StartLimitBurst=3 + +[Service] +Type=simple +# CONTRACT: The user-managed executable is the canonical manual and service +# entry point; the repository/build location must not leak into this unit. +ExecStart=%h/.local/bin/trainlog -w +# INVARIANT: Trainlog stays in the foreground, owns its ordered SIGTERM +# shutdown, and always keeps the frozen loopback address and port contract. +KillSignal=SIGTERM +TimeoutStopSec=20 +Restart=on-failure +RestartSec=10 + +# These protections do not isolate the home directory: Trainlog must retain +# access to its SQLite data and configuration below ~/.local/share and ~/.config. +NoNewPrivileges=true +PrivateTmp=true +ProtectSystem=strict +ProtectControlGroups=true +ProtectKernelModules=true +ProtectKernelTunables=true +RestrictSUIDSGID=true +LockPersonality=true +SystemCallArchitectures=native + +[Install] +WantedBy=default.target diff --git a/systemd/.config/systemd/user/trainlog-web.service.d/sync-generation.conf b/systemd/.config/systemd/user/trainlog-web.service.d/sync-generation.conf new file mode 100644 index 000000000..a53fafcf0 --- /dev/null +++ b/systemd/.config/systemd/user/trainlog-web.service.d/sync-generation.conf @@ -0,0 +1,2 @@ +[Service] +Environment=TRAINLOG_SYNC_GENERATION_CONFIG=/home/fy59/.config/trainlog/sync-generation-config-v1.json