deploy/nginx-upush.nours.eu.conf names a host and the certificate layout of one machine; it belongs with that machine's configuration, not with the server. The README keeps the two settings that matter for the stream.

The installed copy stays at /usr/local/etc/nginx/sites/upush.nours.eu.conf. leaf check-in: 0e210f9557 user: bapt tags: trunk

deploy/rc.d-upushd and deploy/nginx-upush.nours.eu.conf were described in the previous commit message but not added: fossil needs an explicit add for a new file. check-in: 59da348aef user: bapt tags: trunk

deploy/rc.d-upushd starts the server under daemon(8) as the upush user: the state directory is created in 0700, and the directory of the unix socket is made setgid on www so the socket belongs to the group nginx runs as. The variable is not named upushd_user on purpose, because rc.subr reads ${name}_user as "run the command as this user" and would start daemon(8) unprivileged, which then fails on initgroups().

daemon(8) resets the umask from the login class once it has dropped privileges, so the socket cannot be born group writable: start_postcmd waits for it and sets the group and the mode.

deploy/nginx-upush.nours.eu.conf proxies to that socket with proxy_buffering off, without which nginx swallows the event stream.

make install now installs the rc.d script. check-in: f61d707658 user: bapt tags: trunk

A listen spec that starts with '/' is now a socket path instead of an addr:port pair, which is what a reverse proxy on the same host wants.

The socket directory is opened before cap_enter() so the file can be unlinked on the way out through a descriptor limited to CAP_UNLINKAT. A socket left by a crash is removed at startup, but only once a connect() to it has failed: a second upushd then refuses to start rather than take the socket away from the first, which would keep running unreachable.

The socket file carries the umask of the process, and connecting to it needs write permission, so upushd has to run as the proxy's user or share its group.

tests/api_test.py exercises the server through the socket: start, health, device, status, and the file gone after SIGTERM. check-in: 399bc4def8 user: bapt tags: trunk

libucl was only used by src/config.c: the JSON is written and read by hand in src/util.c. The configuration now goes through btk's ini_parse(), so upushd no longer links libucl at all.

Values are taken literally, so upushd.conf.sample drops the quotes around them; a value keeps a '#' unless a blank precedes it, which is what starts a comment. Configuration errors now name the file and the line, e.g. "upushd: upushd.conf:2: maxbody must be a positive integer".

debug = true now forces LOG_DEBUG on its own: the old code applied it only inside the loglevel branch, so it did nothing when loglevel was absent. check-in: 5bd22f08b7 user: bapt tags: trunk