mwiegand 593611e194 fix(deploy): drop PrivateTmp on web service so fuse mounts propagate ... PrivateTmp=true gives the unit a private mount namespace. The worker's fuse-overlayfs mount lives only inside that namespace, so the host cannot see it and the gameserver unit (started via systemctl, with its own namespace inherited from the host) also cannot see it. The gameserver unit then fails CHDIR on /var/lib/left4me/runtime/<name>/merged/left4dead2. The mount must land in the host namespace so the gameserver unit inherits it at unshare time. Remaining hardening: dedicated user, ProtectSystem=full, ReadWritePaths, sudoers allowlist limited to two helper scripts. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-07 01:57:43 +02:00
..
etc/sudoers.d	feat(deploy): add production-like test deployment	2026-05-06 19:30:10 +02:00
usr/local	fix(deploy): drop PrivateTmp on web service so fuse mounts propagate	2026-05-07 01:57:43 +02:00