Repository navigation
finbot.service: DynamicUser and sandbox; the util tools find the service's data directory - #58
Merged
Merged
Conversation
…oduction unit; the checkout in /opt/finbot Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JVEkZofdPjQ4jtXFKipeUX
…he data-directory doc say where the files go Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JVEkZofdPjQ4jtXFKipeUX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR holds
finbot.serviceDynamicUser=yes,StateDirectory=finbot, the checkout in/opt/finbot, and the sandbox (ProtectSystem=strict,ProtectHome=yes,PrivateTmp,PrivateDevices,PrivateUsers,MemoryDenyWriteExecute, empty capability sets,SystemCallFilter=@system-service, theProtect*kernel lines,RestrictAddressFamilies, memory limits).TasksMax=256(production uses 64): finbot runs a thread per message, press, scheduled job and priming task.Data directory
lib/config.py: the util tools (sync_defaults.py,check_config.py,flush.py,slack_manifest.py, which setFINBOT_CHECK_ONLY), run by hand withoutSTATE_DIRECTORY, use/var/lib/private/finbotwhen it exists, so they act on the directory the service reads. The bot itself never does;DATA_DIRandSTATE_DIRECTORYstill win.doc/install.md: the Debian steps in order (code in/opt/finbot,finbot.env, check, start the unit, optional settings with the exactsudocommands);doc/configuration.md,doc/caching.md,defaults/finbot.env: the data-directory rule stated once, the migration steps, and not to setDATA_DIRunder the unit.origin/mainis merged in.Test plan
.venv/bin/python -m unittest discover -s tests -b(652 tests, offline)systemd-analyze verify finbot.service(only complaints:/opt/finbotdoes not exist in the cloud environment)Generated by Claude Code