v0.90.0 — enable finishes the job

dns enable now rewrites and restarts the supervised bridge's unit itself. That removes the last step anyone had to run by hand:

moshcode dns service --proxy-probe <a real name> --write

What was wrong

enable could detect the pinned-TLS proxy, install it, start it, watch it take 443 and put its root in the system trust store — and still leave every Moshpit name answering its origin. What a resolver answers with is fixed when it spawns, and the bridge was already running: startDaemon saw a live pidfile, reported "already running", and left it alone. Correct, and the reason proxy mode arrived a reboot late.

Stopping the bridge did not help either. The unit is Restart=always, so systemd put the same ExecStart back within the second.

The only thing that changes a supervised bridge's mind is rewriting its unit and restarting it, and enable was the one command that could not. It escalates, and the bridge is a user unit — so systemctl --user from there addressed root's session, which has no bridge in it and never has. The unit that had to change belongs to a session the escalated half of the command cannot see.

An escalated run now drops back to the invoking user and derives the runtime directory their session bus lives in. servicePaths resolves the operator's home for the same reason: escalated, that was /root, so the unit was being written where systemd would never look for it. And installService restarts rather than only enable --now, which starts a stopped unit and does nothing at all to a running one.

No name is invented and no handshake is attempted — enable knows the proxy address because it started the proxy. Upstreams are read back off the unit's own ExecStart rather than rediscovered, because by that point the machine may already be routing every lookup at the bridge, and a bridge whose upstream is itself resolves nothing.

Also in this release

• disable stops the unit through systemd instead of signalling a pid that Restart=always replaces within the second. It used to print "bridge stopped" on a machine where the bridge was still up. The unit file stays: turning resolution off for an afternoon should not delete a unit you may have written yourself.
• A restart that never answers refuses the machine its routing. systemctl restart returns as soon as a Type=simple unit forks, so it returns 0 for a bridge that forked and died — and the next thing enable does is point every lookup on the machine at that port.
• The closing note no longer tells a supervised machine its bridge dies at reboot.
• A rollback no longer signals the pid of a bridge it did not start, or announce it removed one it did not.
• doas publishes a user name and no uid, which would have addressed root's session silently. The uid falls back to the owner of the operator's home.

Upgrading

moshcode update

On a desktop that already has Moshpit routing, follow it with moshcode dns enable once. That is now the whole of it.