# infra/config/fly-tmpfiles.conf — pushed to /etc/tmpfiles.d/fly.conf.
# docs/design/infra.md section 2, plus two additions noted inline (marked
# ADDED, not in the original design list) needed by the secrets table and
# the watchdog escalation gate in section 3.
d /run/fly            0750 fly  fly  -
d /run/fly/pulse      0750 fly  fly  -
d /run/fly/state      0750 fly  fly  -
d /run/fly/wd         0750 fly  fly  -
d /var/lib/fly        0750 fly  fly  -
d /var/lib/fly/chrome 0700 fly  fly  -
d /srv/fly/state      0750 fly  fly  -
d /srv/fly/media/rec  0750 fly  fly  -
d /srv/fly/media/highlights 0750 fly fly -
d /etc/fly            0755 root root -
d /etc/fly/creds      0700 root root -
# ADDED: bridge refresh tokens, per infra.md's secrets table
# (/var/lib/fly/bridge/tokens.json, fly:fly 0600).
d /var/lib/fly/bridge 0750 fly fly -
# ADDED: watchdog's persistent reboot-rate gate
# (/var/lib/fly/wd/last-reboot, section 3 "gated ... so it cannot reboot
# more than once an hour"). /run/fly/wd above is tmpfs and clears on
# reboot, which is correct for the per-unit fail counters but wrong for
# the reboot gate itself.
d /var/lib/fly/wd     0750 fly fly -
# ADDED: ROM staging directory (section 6: "staged to /srv/fly/rom/<sha256>.gb, mode 0400 fly:fly").
d /srv/fly/rom         0750 fly fly -
# ADDED: the watchdog's Prometheus textfile sink (section 3, "Notification":
# /var/lib/node_exporter/textfile/fly_watchdog.prom, also written by
# bin/fly-retention and bin/fly-backup-stage). Nothing created it before, and
# /var/lib/node_exporter is root-owned ground that fly-watchdog — User=fly —
# cannot make for itself: on the P0 spike run 2 the directory did not exist,
# so every watchdog pass died on its own `mkdir -p` before running a single
# check. Owned by fly because the three scripts that write here all run as
# fly; world-readable because node_exporter scrapes it as `prometheus`.
d /var/lib/node_exporter           0755 root root -
d /var/lib/node_exporter/textfile  0755 fly  fly  -