Michal Tuszowski f17cf7fdd8 radio: run liquidsoap as dedicated non-root user; quiet pulse warnings ...

- Liquidsoap refuses to start as root (init: security exit). Instead of
  the settings.init.allow_root override, the image now has a dedicated
  'radio' user (audio + pulse-access groups) and the entrypoint drops
  privileges via setpriv after doing its root-only work (volume seeding,
  icecast config render/start, pulse start, chown of the data volume).
  The icecast secret is made group-readable (640 root:radio) because the
  script parses it directly.
- The opam root moved from /root/.opam to /opt/opam so the liquidsoap
  binary AND its stdlib .liq files are readable by the radio user.
  NOTE: this invalidates the cached opam build layer - next build
  recompiles liquidsoap (~15-20 min).
- pulseaudio (PULSE_MODE=internal) now starts with
  --disallow-module-loading: system.pa startup modules still load, only
  later client-requested loads are blocked, and the system-mode warning
  goes away. The 'forcibly disabling SHM mode' notice is inherent to
  system mode and harmless (documented).

Keeps the user's libcurl4-gnutls-dev build-dep fix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-08 23:42:41 +02:00

..

DEPLOYMENT_GUIDE.md

Syncinc script drop in

2025-10-30 16:58:41 +01:00

DOCKER_PROXMOX.md

radio: run liquidsoap as dedicated non-root user; quiet pulse warnings

2026-07-08 23:42:41 +02:00

MIGRATION_WORKING_COPY_TO_PROTOTYPE.md

docs: add working-copy -> prototype migration runbook

2026-06-29 11:31:10 +02:00