v.34.5_fix_systemd

README.md

@@ -63,6 +63,12 @@ For Debian 13+ source installation, manual compilation, managed updates or Docke
 
 Typical managed Linux defaults: HTTP on `:80`, HTTPS on `:443`, local administration at `http://127.0.0.1:9090`, private data in `/var/lib/rustproxy`. The initial public certificate is self-signed. **There is no default administrator password.** Initialize administration locally and assign trusted certificates before public use.
 
+Updated Linux service templates allow **read-only** access to static website
+roots under `/home`, `/var/www` and `/srv` using Unix groups or ACLs without
+per-directory systemd overrides. The service still runs unprivileged with
+`ProtectSystem=strict`; external certificate paths have stricter trust/owner
+checks. See [Linux filesystem access](docs/INSTALL.md#linux-debrpm-read-only-access-to-external-paths).
+
 ## First configuration
 
 1. Install and start the service, then initialize the administrator using the local CLI.