cabbage/rvbox
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: finalize v1 design and Windows service model

Browse Source
This commit is contained in:
cabbage
2026-08-28 11:00:58 +00:00
parent a89253be96
commit 85f4d5d2a0
11 changed files with 833 additions and 241 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration.md
+23 -5
View File
@@ -4,11 +4,19 @@ RVBox v1 uses TOML 1.0 for daemon configuration. The normative annotated
examples are [`examples/server.toml`](examples/server.toml) and
[`examples/client.toml`](examples/client.toml). They list every supported v1
knob, with the routing, persistence, and safety limits first in each section.
The runnable Windows-first deployment example is
[`examples/client.windows.toml`](examples/client.windows.toml); omitted entries
use the defaults documented by the all-knob client reference.
## Loading and precedence
- `rvbox-server --config PATH` and `rvbox --config PATH` load one UTF-8 TOML
file. There is no implicit merge of multiple files and no hot reload in v1.
file. There is no implicit merge, runtime rewrite, or hot reload in v1.
On Windows, the SCM service command line holds the canonical explicit config
path; omitting it during installation selects the resolved
`%ProgramData%\RVBox\client.toml`; first run creates its annotated template
and the service reports not-ready until routing is valid rather than
connecting to a placeholder server.
- Precedence is compiled default, then TOML, then an explicitly supplied CLI
flag. Flags exist for operationally important scalar keys; they use the same
validation as TOML. RVBox does not implicitly import configuration from
@@ -21,10 +29,13 @@ knob, with the routing, persistence, and safety limits first in each section.
bytes; comments show the equivalent binary unit. URLs and paths are strings.
- Relative paths are rejected for state, socket, CA, shell-executable, and
allowed-CWD-root fields. `client.daemon_cwd` is resolved once at startup and
then stored and advertised as an absolute path. The annotated client example
uses Unix paths; a Windows deployment replaces `state_dir`, `daemon_cwd`, and
relevant shell paths with absolute Windows paths. Shell fields for the other
platform are syntax-checked but not resolved or advertised.
then stored and advertised as an absolute path. On Unix it is the omitted-CWD
default; on Windows it is the protected parent under which the service creates
an ACL-isolated default directory for the selected execution identity. The
annotated client example uses Unix paths; a Windows deployment replaces
`state_dir`, `daemon_cwd`, and relevant shell paths with absolute Windows
paths. Shell fields for the other platform are syntax-checked but not resolved
or advertised.
- The daemon prints its effective configuration after validation, with no
command data or TLS material. Since v1 stores command/environment payloads in
plaintext, configuration output is hygiene rather than a secrecy guarantee.
@@ -44,6 +55,13 @@ Any enabled non-loopback bind produces a conspicuous warning but is permitted by
the accepted v1 debugging contract. The control Unix socket always uses mode
`0600`; it is not a configurable relaxation.
Windows automatic start is SCM state, not TOML state. Installation registers
the machine-wide service as Automatic; an administrator may change it to Manual
through the tray or normal service-management tools. RVBox has no
`windows.start_on_boot` key and never attempts to reconcile two sources of
truth. The optional per-user tray uses the installer-created logon registration
and is never required for service readiness or command execution.
## Shell executable resolution
Each `ShellType` maps to one startup-validated absolute executable path from