simplify systemd service file about tinc HOT 8 OPEN

That might work for you, but it might not work for everybody. In particular: the chroot environment has to be prepared so hostname resolution continues to work and files must be readable by user nobody. But also if one has more scripts than just tinc-up (which is the only one executed before the setuid() call), then user nobody is probably not what you want. So unfortunately I cannot add that without breaking a lot of people's setup.

from tinc.

since journald automatically separate logs from each service, I recommend adding '-d 1' to show more details regarding connection failed, re-established, etc.

from tinc.

It could also be 0 or 2, depending... 2 can also be very useful, at one point I forgot to chmod +x tinc-up and it didn't work...

DEBUG LEVELS
     The tinc daemon can send a lot of messages to the syslog.  The higher the debug level, the more mes‐
     sages it will log.  Each level inherits all messages of the previous level:

     0       This will log a message indicating tincd has started along with a version number.  It will
             also log any serious error.

     1       This will log all connections that are made with other tinc daemons.

     2       This will log status and error messages from scripts and other tinc daemons.

     3       This will log all requests that are exchanged with other tinc daemons. These include authenti‐
             cation, key exchange and connection list updates.

     4       This will log a copy of everything received on the meta socket.

     5       This will log all network traffic over the virtual private network.

from tinc.

Hi,
I've got another safety related improvement:

ExecStart=/usr/sbin/tincd -n %i -D -R -U nobody

This would automatically chroot tincd to the config directory and drop privileges to 'nobody' user.

Works for me on Debian Stretch + ArchLinux.

from tinc.

@gsliepen can you take a look at [email protected] because on debian 10 I had to manually restart the service after boot because

Oct 02 19:05:53 tincvpn01 tincd[341]: bridge br0 does not exist!

In /lib/systemd/system/[email protected] I added
[Unit]
After=network.target

and now everything works as expected....

from tinc.

@tuxcrafter , that's because tinc comes up before your br0. br0 is a bridge device, I put my tinc on a bridge as well. I have to add pre-up /sbin/brctl addbr br0 in my /etc/network/interfaces.d/br0 to make it work. The way systemd brings up the network is quite complicated, with dependencies and etc.

from tinc.

Closing issue as PR #134 has been closed.

from tinc.

This ticket was reopened, because there are two pull requests related to this.

from tinc.