yggdrasil-go icon indicating copy to clipboard operation
yggdrasil-go copied to clipboard

Suggested compatibility tweaks

Open jgoerzen opened this issue 1 year ago • 1 comments

Hello,

As discussed on the Matrix channel, I would like to suggest two compatibility tweaks.

First, the default configuration file location should be changed from /etc/yggdrasil.conf to /etc/yggdrasil/yggdrasil.conf. This has a security benefit in that /etc/yggdrasil can have restricted permissions that can prevent leakage of private keys from editor backup files. I have already patched this change into the Debian package for this reason.

Secondly, the system should use the compiled-in default path for AdminListen if one isn't given in the config file, and the generated config file should either omit it or have it commented out. This will facilitate cross-system portability of config files.

Issues such as #965 are likely caused by the second issue.

On Debian, I put the files in /var/run/yggdrasil so that I can run the daemon in full lockdown mode (not as root, non-writable filesystem except that one directory). This is not necessarily the right answer for non-systemd systems, for which making the directory may be more complicated. So I'm not suggesting changing the default path, just making it implicit.

jgoerzen avatar Jul 12 '23 01:07 jgoerzen

Interim instructions for those migrating to the Debian package are here: https://salsa.debian.org/go-team/packages/yggdrasil/-/blob/debian/sid/debian/README.Debian

jgoerzen avatar Jul 31 '23 13:07 jgoerzen