| 1 | #!/sbin/openrc-run |
| 2 | |
| 3 | name="rcvd" |
| 4 | description="rcvd - Resilient, Cryptographic, Verifiable DNS" |
| 5 | RCVD_CONF="${RCVD_CONF:-/etc/rcvd/rcvd.toml}" |
| 6 | |
| 7 | command="/usr/bin/rcvd" |
| 8 | command_args="${RCVD_OPTS:--config ${RCVD_CONF}}" |
| 9 | command_user="${RCVD_USER:-rcvd}:${RCVD_GROUP:-rcvd}" |
| 10 | pidfile="/run/${RC_SVCNAME}.pid" |
| 11 | required_files="${RCVD_CONF}" |
| 12 | |
| 13 | # Let the unprivileged rcvd user bind privileged ports (<1024) — e.g. a |
| 14 | # Mode-2 LAN-facing DoQ/DoT service on :853, or a loopback :53 listener |
| 15 | # (rcvd only ever binds :53 on 127.0.0.1/::1). Applied by supervise-daemon at |
| 16 | # start, so it survives reboots and reinstalls (unlike a file setcap, which |
| 17 | # install strips). Comment out if rcvd only uses unprivileged ports (e.g. :5300). |
| 18 | capabilities="^cap_net_bind_service" |
| 19 | |
| 20 | depend() { |
| 21 | need net |
| 22 | after firewall |
| 23 | use logger |
| 24 | provide dns |
| 25 | } |
| 26 | |
| 27 | start_pre() { |
| 28 | # /run and /var/log are tmpfs on Alpine — recreate the runtime dirs each boot. |
| 29 | # /run/rcvd holds the stats socket; the log dir/file are created empty. |
| 30 | checkpath --directory --owner "${command_user}" --mode 0755 /run/rcvd |
| 31 | checkpath --directory --owner "${command_user}" --mode 0755 /var/log/rcvd |
| 32 | checkpath --file --owner "${command_user}" --mode 0640 /var/log/rcvd/rcvd.log |
| 33 | } |