Running as a service

Each release publishes two systemd units:

Unit	Layout
rchat-server.service	Default (the direct unit). The relay owns port 443 and terminates TLS itself, with [server.acme] or [server.tls]. install.sh installs this one.
rchat-server-proxy.service	The relay terminates TLS itself on 127.0.0.1:8443, behind a TCP passthrough that sends PROXY protocol v2. See Behind a TCP front end.

Both are at https://assets.r-chat.net/<version>/; replace 1.1.0 in the commands below with the version you run.

Neither unit runs the relay without TLS. For FreeBSD, see FreeBSD.

Install the direct unit

install.sh installs the direct unit as /etc/systemd/system/rchat-server.service and creates the user and directories, so after it only the identity and systemctl enable --now rchat-server remain. By hand:

sudo useradd --system --user-group --home-dir /var/lib/rchat --no-create-home --shell /usr/sbin/nologin rchat
sudo install -d -m 0700 -o rchat -g rchat /var/lib/rchat
sudo -u rchat /usr/local/bin/rchat-server --config /etc/rchat/server.toml --init-relay-identity
curl -fsSL -o rchat-server.service https://assets.r-chat.net/1.1.0/rchat-server.service
sudo install -m 0644 rchat-server.service /etc/systemd/system/rchat-server.service
sudo systemctl daemon-reload
sudo systemctl enable --now rchat-server

Set relay_identity_path = "/var/lib/rchat/relay_identity.key" in the config file, so the key sits in the unit’s only writable directory. See Relay identity.

The pages on this site name the unit rchat-server. If you install the behind-proxy unit under its own name, use rchat-server-proxy in the commands instead.

What the unit does

• Runs as rchat, not root. ExecStart=/usr/local/bin/rchat-server --config /etc/rchat/server.toml, with no --no-tls.
• Binds port 443 without root. It grants AmbientCapabilities=CAP_NET_BIND_SERVICE, and the capability bounding set contains nothing else.
• Keeps state private. StateDirectory=rchat keeps /var/lib/rchat at mode 0700, and UMask=0077 makes every file the service creates owner-only. That directory holds the ACME cache, the relay identity key and, if enabled, the encrypted queue file.
• Keeps the queue key in memory. RuntimeDirectory=rchat is a tmpfs at /run/rchat, kept across restarts but not reboots (RuntimeDirectoryPreserve=yes). Before each start the unit creates /run/rchat/queue.key if it is missing, for encrypted queue persistence.
• Is sandboxed:
  • ProtectSystem=strict, ProtectHome=true and ReadWritePaths=/var/lib/rchat;
  • PrivateTmp, PrivateDevices, ProtectClock, ProtectHostname, ProtectKernelTunables, ProtectKernelModules, ProtectKernelLogs, ProtectControlGroups and ProtectProc=invisible;
  • NoNewPrivileges, RestrictSUIDSGID, RestrictRealtime, RestrictNamespaces, LockPersonality and MemoryDenyWriteExecute;
  • RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX, and SystemCallFilter=@system-service minus @privileged @resources.
• Limits resources. LimitNOFILE=1048576 (keep it well above max_connections), MemoryMax=3G (raise it if you raise the queue budgets), and no core dumps (LimitCORE=0; the relay also disables them itself).
• Never gives up restarting. Restart=on-failure with StartLimitIntervalSec=0. Restarts back off from 5 seconds to 60 seconds over 10 restarts (RestartSteps=10, RestartMaxDelaySec=60, systemd 254 or newer; older versions keep the fixed RestartSec=5).

Because of ProtectSystem=strict, the relay can write only under /var/lib/rchat and /run/rchat. Keep cache_dir, relay_identity_path and persist_path under /var/lib/rchat, and persist_key_path under /run/rchat. /etc/rchat is read-only to the service, which is fine for the config file and static certificates.

Day-to-day commands

sudo systemctl status rchat-server
sudo systemctl restart rchat-server     # after changing server.toml
sudo systemctl reload rchat-server      # SIGHUP: reload a static certificate
journalctl -u rchat-server -f           # follow the logs

The relay does not re-read server.toml on reload. SIGHUP reloads only the static certificate files, and in ACME mode it does nothing. Restart to apply configuration changes.

Other init systems

On FreeBSD, use the rc.d script on the FreeBSD page. Elsewhere, run the same command as an unprivileged user that may bind port 443:

/usr/local/bin/rchat-server --config /etc/rchat/server.toml

Keep the ACME cache and the relay identity key on persistent storage that only that user can read.