5039163a52
The machine seed moves out of the user session: souveraine-machined owns /var/lib/souveraine/seed-id as the souveraine system user and serves pubkey/sign over /run/souveraine/machined.sock (SO_PEERCRED logged, domain-separated signatures, group-gated socket). Seed is a precondition - provision via 'souveraine machine init --fresh|--migrate-from', the daemon never generates. reach/consult now resolves the machine key through the daemon with a loud legacy fallback. Hardened system unit + sysusers shipped in the Arch package.
5 lines
299 B
Text
5 lines
299 B
Text
# The `souveraine` system user owns the machine's system tier: the machine
|
|
# seed (/var/lib/souveraine) and the machined socket (/run/souveraine).
|
|
# Session users join the group to talk to the daemon:
|
|
# usermod -aG souveraine <user>
|
|
u souveraine - "SouveraineOS system tier" /var/lib/souveraine -
|