fix(seedbox): give the watchdog a bus to systemd, and stop passing off a daemon we watched die

[ralyodio]

Follow-up to #139–#141, which each tried to keep torlink alive and each left the box still answering ECONNREFUSED. Two concrete defects, both verified.

1. The watchdog could never reach systemd

.torlnk-watchdog.sh runs from cron. cron has no login session, so systemctl --user fails with "Failed to connect to user scope bus" — and the call is >/dev/null 2>&1, so it failed silently on every run. Reproduced locally:

$ env -u XDG_RUNTIME_DIR -u DBUS_SESSION_BUS_ADDRESS systemctl --user is-system-running
Failed to connect to user scope bus via local transport:
$DBUS_SESSION_BUS_ADDRESS and $XDG_RUNTIME_DIR not defined

So every 5 minutes the watchdog skipped the systemd restart it exists to perform and fell through to launching a bare, unsupervised --daemon — which then fought the still-enabled Restart=always unit for the serve port. Whichever lost crash-looped forever against a port it could never bind. The supervision added in #139 was being bypassed by the watchdog meant to back it up.

Fix: export XDG_RUNTIME_DIR / DBUS_SESSION_BUS_ADDRESS pointing at the lingering user manager. $(id -u) is escaped so it resolves when the watchdog runs, not when the heredoc is written (a bare $(id -u) in the unquoted heredoc would bake in the provisioning shell's uid).

Also: systemctl restart exiting 0 does not mean the port is bound — restarts are async. The old restart … && exit 0 short-circuit treated a queued restart as success. Now it re-probes /health for ~12s and only falls back to an unsupervised daemon once systemd has demonstrably not taken over, so the two can't race.

2. Provisioning reported success for a daemon it watched die

#141 added the stable step — re-probe after ~15s and report if torlink is already gone. But provisionTorlink derived ok from the serve step alone, and RESULT|ok is echoed unconditionally. So install-torlink returned 200, wired the fresh token into the account config, and rendered a green "installed" even when the script had just reported the daemon was dead — and the next status poll said ECONNREFUSED. That's the reinstall-says-OK-then-unreachable loop.

Fix: let stable fail veto success, so the route 502s with the steps (including the journal tail explaining what killed it) instead of saving a dead box. A missing stable step — older script output — still passes. The probe now retries 3× as well, since it gates the whole install and one dropped packet must not fail a healthy box.

Testing

• 8 new tests: bus env present and ordered before the real systemctl call (comment-stripped, so it asserts on commands not prose), uid resolved at run time, health re-probe between restart and fallback, retry loop, and provisionTorlink returning ok:false/token:null on stable fail (+ back-compat when the step is absent).
• Full suite green: 178 files, 2465 passed, typecheck and eslint clean.

Note

This makes recovery work going forward; it does not revive a box that is down right now. That still needs systemctl --user restart torlink-serve torlink-files on the seedbox, or a re-run of the installer.

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.