#!/sbin/openrc-run

name="rcvd"
description="rcvd - Resilient, Cryptographic, Verifiable DNS"
RCVD_CONF="${RCVD_CONF:-/etc/rcvd/rcvd.toml}"

command="/usr/bin/rcvd"
command_args="${RCVD_OPTS:--config ${RCVD_CONF}}"
command_user="${RCVD_USER:-rcvd}:${RCVD_GROUP:-rcvd}"
pidfile="/run/${RC_SVCNAME}.pid"
required_files="${RCVD_CONF}"

# Let the unprivileged rcvd user bind privileged ports (<1024) — e.g. a
# Mode-2 LAN-facing DoQ/DoT service on :853, or a loopback :53 listener
# (rcvd only ever binds :53 on 127.0.0.1/::1). Applied by supervise-daemon at
# start, so it survives reboots and reinstalls (unlike a file setcap, which
# install strips). Comment out if rcvd only uses unprivileged ports (e.g. :5300).
capabilities="^cap_net_bind_service"

depend() {
	need net
	after firewall
	use logger
	provide dns
}

start_pre() {
	# /run and /var/log are tmpfs on Alpine — recreate the runtime dirs each boot.
	# /run/rcvd holds the stats socket; the log dir/file are created empty.
	checkpath --directory --owner "${command_user}" --mode 0755 /run/rcvd
	checkpath --directory --owner "${command_user}" --mode 0755 /var/log/rcvd
	checkpath --file --owner "${command_user}" --mode 0640 /var/log/rcvd/rcvd.log
}