@tpsdev-ai/flair 0.30.0 → 0.31.0

package/templates/bin/flair-federation-sync.sh.tmpl

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Flair federation sync driver shim.
+# Deployed by `flair federation sync enable` to {{SHIM_PATH}}.
+# Invoked by launchd (macOS) or systemd (Linux) every {{INTERVAL_SECONDS}}s.
+#
+# One-shot by design: every run is a fresh, fully bounded process. See
+# src/federation/scheduler.ts for why this is a periodic one-shot rather than
+# a supervised long-lived watcher.
+#
+# The admin password is NEVER written into the scheduler unit. The unit
+# carries FLAIR_ADMIN_PASS_FILE — a PATH — and the CLI reads the file itself
+# through readAdminPassFileSecure(), which refuses anything not owner-only.
+# Passing the path (not the value) also keeps it out of `ps`.
+#
+# Logs land in {{HOME}}/.flair/logs/federation-sync.{stdout,stderr}.log.
+set -e
+
+if [ -n "${FLAIR_TARGET:-}" ]; then
+  set -- --target "${FLAIR_TARGET}"
+else
+  set --
+fi
+
+if [ -n "${FLAIR_ADMIN_PASS_FILE:-}" ] && [ -f "${FLAIR_ADMIN_PASS_FILE}" ]; then
+  set -- "$@" --admin-pass-file "${FLAIR_ADMIN_PASS_FILE}"
+fi
+
+exec "{{FLAIR_BIN}}" federation sync "$@"

package/templates/launchd/dev.flair.federation.sync.plist.tmpl

@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>dev.flair.federation.sync</string>
+
+  <key>ProgramArguments</key>
+  <array>
+    <string>{{SHIM_PATH}}</string>
+  </array>
+
+  <!-- Periodic one-shot. NOT KeepAlive: the sync carries no state between
+       runs, and KeepAlive restarts a process that exits while doing nothing
+       for one that hangs. See src/federation/scheduler.ts. -->
+  <key>StartInterval</key>
+  <integer>{{INTERVAL_SECONDS}}</integer>
+
+  <!-- Sync once as soon as the job is loaded, so `enable` visibly works
+       instead of leaving the operator waiting out a whole interval. -->
+  <key>RunAtLoad</key>
+  <true/>
+
+  <key>StandardOutPath</key>
+  <string>{{HOME}}/.flair/logs/federation-sync.stdout.log</string>
+
+  <key>StandardErrorPath</key>
+  <string>{{HOME}}/.flair/logs/federation-sync.stderr.log</string>
+
+  <key>WorkingDirectory</key>
+  <string>{{HOME}}</string>
+
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>HOME</key>
+    <string>{{HOME}}</string>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+    <!-- A PATH to the password file, never the password. -->
+    <key>FLAIR_ADMIN_PASS_FILE</key>
+    <string>{{ADMIN_PASS_FILE}}</string>
+    <key>FLAIR_TARGET</key>
+    <string>{{FLAIR_TARGET}}</string>
+  </dict>
+</dict>
+</plist>

package/templates/systemd/flair-federation-sync.service.tmpl

@@ -0,0 +1,21 @@
+[Unit]
+Description=Flair federation sync (one-shot, driven by flair-federation-sync.timer)
+After=network-online.target
+
+[Service]
+# Type=oneshot, not a Restart=always long-lived watcher: the sync carries no
+# state between runs, and every network call inside it is bounded by its own
+# timeout, so a run always terminates and the timer always gets to fire the
+# next one. See src/federation/scheduler.ts.
+Type=oneshot
+ExecStart={{SHIM_PATH}}
+# A PATH to the password file, never the password.
+Environment=FLAIR_ADMIN_PASS_FILE={{ADMIN_PASS_FILE}}
+Environment=FLAIR_TARGET={{FLAIR_TARGET}}
+StandardOutput=append:{{HOME}}/.flair/logs/federation-sync.stdout.log
+StandardError=append:{{HOME}}/.flair/logs/federation-sync.stderr.log
+
+# No [Install] section: this unit is started by flair-federation-sync.timer,
+# which is what `flair federation sync enable` enables. A WantedBy here would
+# only invite someone to enable the service directly and get exactly one sync
+# per boot.

package/templates/systemd/flair-federation-sync.timer.tmpl

@@ -0,0 +1,16 @@
+[Unit]
+Description=Flair federation sync timer (every {{INTERVAL_SECONDS}}s)
+
+[Timer]
+# Sync shortly after the timer starts (enable, and every boot thereafter), so
+# `enable` visibly works instead of leaving the operator waiting out a whole
+# interval. The launchd side gets this from RunAtLoad.
+OnActiveSec=10s
+# Then repeat, measured from the END of the previous run — a slow sync delays
+# the next one rather than overlapping with it.
+OnUnitActiveSec={{INTERVAL_SECONDS}}s
+AccuracySec=30s
+Unit=flair-federation-sync.service
+
+[Install]
+WantedBy=timers.target