max / makenotwork

Say in bentod.service that the tailnet bind and its token are live, not hypothetical

Author: Max Johnson <me@maxj.phd> · 2026-08-18 13:25 UTC

Signed with PGP, not checked

Commit: 1453a01c50042976c1682d94ef2bcd628b236426

Parent: a9af641

1 file changed, +17 insertions, -3 deletions

M bento/deploy/bentod.service +17 -3

			@@ -35,9 +35,23 @@
35	35		Restart=on-failure
36	36		RestartSec=5
37	37		Environment=BENTO_CONFIG=%h/.config/bento/bento-daemon.toml
38		-	# Loopback bind (default) needs no token. For a tailnet bind, set listen to the
39		-	# tailnet IP in bento-daemon.toml AND provide BENTO_API_TOKEN here, e.g.:
40		-	# EnvironmentFile=-%h/.config/bento/bento.env # contains BENTO_API_TOKEN=...
	38	+	# This daemon binds the tailnet, not loopback, and has since 2026-07-29: the
	39	+	# ops-viewer panel on astra polls it, and a loopback bind was only ever visible
	40	+	# to a viewer on fw13. Two consequences, and neither is optional.
	41	+	#
	42	+	# bentod REFUSES to start on a non-loopback listen unless BENTO_API_TOKEN is
	43	+	# set, so the file below is load-bearing rather than an example. Keep the
	44	+	# leading `-` so a fresh machine can start the unit before the token file
	45	+	# exists; the daemon will still refuse the tailnet listen until it does.
	46	+	#
	47	+	# Every mutating call carries the same token as a bearer header. /build and
	48	+	# /retry are behind the auth middleware, so a publish is:
	49	+	# curl -X POST http://fw13:8765/build -H "authorization: Bearer $TOKEN"
	50	+	# -H 'content-type: application/json' -d '{"app":"NAME","version":"X.Y.Z"}'
	51	+	# (one command; wrapped here because a trailing backslash in a systemd
	52	+	# comment is a line continuation, not punctuation)
	53	+	# The read routes (/state, /release, /logs, /events) are open.
	54	+	EnvironmentFile=-%h/.config/bento/bento.env
41	55		StandardOutput=journal
42	56		StandardError=journal
43	57		SyslogIdentifier=bentod