fixes

opnsense-plugin/www/rustproxy/src/etc/rc.d/rustproxy

@@ -17,6 +17,7 @@ load_rc_config "$name"
 : ${rustproxy_data_dir:="/var/db/rustproxy"}
 : ${rustproxy_log_dir:="/var/log/rustproxy"}
 : ${rustproxy_log_file:="${rustproxy_log_dir}/rustproxy.log"}
+: ${rustproxy_run_dir:="/var/run/rustproxy"}
 : ${rustproxy_command:="/usr/local/sbin/rust-proxy"}
 : ${rustproxy_restart_delay:="5"}
 : ${rustproxy_proxy_listen:="0.0.0.0:8080"}
@@ -45,8 +46,8 @@ if [ "$rustproxy_allow_remote_admin" = "1" ]; then
     rustproxy_runtime_args="${rustproxy_runtime_args} --allow-remote-admin"
 fi
 
-pidfile="/var/run/rustproxy-daemon.pid"
-child_pidfile="/var/run/rustproxy.pid"
+pidfile="${rustproxy_run_dir}/daemon.pid"
+child_pidfile="${rustproxy_run_dir}/rustproxy.pid"
 command="/usr/sbin/daemon"
 command_args="-r -R ${rustproxy_restart_delay} -P ${pidfile} -p ${child_pidfile} -u ${rustproxy_user} -o ${rustproxy_log_file} ${rustproxy_command} ${rustproxy_runtime_args}"
 required_files="${rustproxy_command}"
@@ -55,6 +56,13 @@ stop_postcmd="rustproxy_poststop"
 
 rustproxy_prestart()
 {
+    # /var/run is ephemeral and recreated on boot.  daemon(8) writes the
+    # child pidfile after dropping privileges to rustproxy, so the runtime
+    # directory must be writable by the service account.
+    /usr/bin/install -d -o "${rustproxy_user}" -g "${rustproxy_group}" -m 0750 "${rustproxy_run_dir}"
+    /usr/sbin/chown "${rustproxy_user}:${rustproxy_group}" "${rustproxy_run_dir}"
+    /bin/chmod 0750 "${rustproxy_run_dir}"
+
     /usr/bin/install -d -o "${rustproxy_user}" -g "${rustproxy_group}" -m 0700 "${rustproxy_data_dir}"
     /usr/sbin/chown "${rustproxy_user}:${rustproxy_group}" "${rustproxy_data_dir}"
     /bin/chmod 0700 "${rustproxy_data_dir}"
@@ -67,7 +75,7 @@ rustproxy_prestart()
 
 rustproxy_poststop()
 {
-    /bin/rm -f "${child_pidfile}"
+    /bin/rm -f "${child_pidfile}" "${pidfile}"
 }
 
 run_rc_command "$1"