fix(deploy): restarting the daemon broke clients that mount its socket dir (#27)

* fix(deploy): restarting the daemon broke clients that mount its socket dir

systemd removes a RuntimeDirectory when the unit stops and creates a fresh
one on start. Same path, new inode.

A caller running in a container is told to bind-mount the DIRECTORY rather
than the socket file, precisely so it survives the daemon recreating the
socket. That does not help here: the mount pins the caller to the directory
inode that existed when the container started, and after a daemon restart
that inode is orphaned and empty. Every request then fails with ENOENT, and
nothing recovers until the caller is restarted too — which turns a routine
`systemctl restart openbloxd` into an outage for anything using it.

RuntimeDirectoryPreserve=yes keeps the directory across restarts, so the
inode is stable and the mount stays live.

Observed on a real deployment: after a plain restart, the daemon reported the
socket present at the expected path while a client in a container saw no such
file, with the two showing different inodes for the same directory. With this
set, the inode is unchanged across a restart and calls keep working.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(deploy): note the one-time client restart in the unit itself

The migration step was in the PR discussion and in the operator runbook, but
not in the file that actually ships to consumers. A client whose container
started while the daemon ran without RuntimeDirectoryPreserve is still pinned
to the old inode and needs one restart; every restart after that is
transparent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Lutherwaves

deploy/openbloxd.service

@@ -16,6 +16,19 @@ RuntimeDirectory=openbloxd
 # umask gives it. This runtime directory mode is what gates access during
 # that window, so do not loosen it.
 RuntimeDirectoryMode=0750
+# Keep the runtime directory across restarts. Without this, systemd removes
+# /run/openbloxd when the unit stops and creates a fresh one on start — same
+# path, new inode. A client that bind-mounts the DIRECTORY into a container
+# (the documented way to survive the socket itself being recreated) stays
+# pinned to the old inode, which is now orphaned and empty, so every call
+# fails with ENOENT until that client is restarted too. Restarting the broker
+# must not require restarting its callers.
+#
+# One-time migration: a client whose container started while the daemon was
+# running WITHOUT this setting is still pinned to the old inode, so it needs a
+# single restart after this unit is installed. Restarts are transparent from
+# then on.
+RuntimeDirectoryPreserve=yes
 Restart=on-failure
 
 NoNewPrivileges=true