diff --git a/README.md b/README.md index b795b3b..9ef142c 100644 --- a/README.md +++ b/README.md @@ -217,6 +217,7 @@ WorkingDirectory=/home/wowexplorer/onion-wownero-blockchain-explorer-themefork/b Type=simple ExecStart=/home/wowexplorer/onion-wownero-blockchain-explorer-themefork/build/xmrblocks \ + -b /path/to/.wownero/lmdb \ --daemon-url=http://127.0.0.1:34568 \ --enable-json-api \ --enable-autorefresh-option \ @@ -226,16 +227,81 @@ ExecStart=/home/wowexplorer/onion-wownero-blockchain-explorer-themefork/build/xm Restart=always RestartSec=10 -# Hardening -NoNewPrivileges=true -ProtectSystem=strict -ProtectHome=read-only -ReadWritePaths=/home/wowexplorer/.wownero - [Install] WantedBy=multi-user.target ``` +### ⚠️ LMDB Permissions (Important!) + +If your blockchain LMDB is owned by a different user (e.g., `jw` runs wownerod but `wowexplorer` runs the explorer), you need to grant access. **LMDB requires write access to the directory** for memory-mapping even for read-only access. + +#### Option 1: Use ACLs (Recommended) + +```bash +# Install ACL tools +sudo apt install acl + +# Grant wowexplorer access to traverse to the lmdb directory +sudo setfacl -m u:wowexplorer:rx /home/jw +sudo setfacl -m u:wowexplorer:rx /home/jw/.wownero + +# Grant rwx on the lmdb directory (required for LMDB memory-mapping) +sudo setfacl -m u:wowexplorer:rwx /home/jw/.wownero/lmdb + +# Grant rw on the database files +sudo setfacl -m u:wowexplorer:rw /home/jw/.wownero/lmdb/data.mdb +sudo setfacl -m u:wowexplorer:rw /home/jw/.wownero/lmdb/lock.mdb + +# Verify permissions +getfacl /home/jw/.wownero/lmdb/ +``` + +#### Option 2: Add user to group + +```bash +# Add wowexplorer to the jw group +sudo usermod -aG jw wowexplorer + +# Set directory permissions +chmod 711 /home/jw +chmod 750 /home/jw/.wownero +chmod 770 /home/jw/.wownero/lmdb +chmod 660 /home/jw/.wownero/lmdb/* + +# Note: Group changes require service restart or reboot to take effect +sudo systemctl daemon-reexec +sudo systemctl restart wowexplorer +``` + +#### Option 3: Run as the same user + +Simply run the explorer as the same user that owns the blockchain: + +```ini +User=jw +Group=jw +``` + +### Troubleshooting LMDB Permission Errors + +If you see `Failed to open lmdb environment: Permission denied` errors: + +1. **ACLs are most reliable** - Group membership changes aren't picked up by systemd immediately +2. **LMDB needs write access** - Even for "read-only" access, LMDB needs to write lock files +3. **Check the full path** - Every directory from `/` to the lmdb folder needs execute permission +4. **Verify with sudo** - Test access manually: `sudo -u wowexplorer ls -la /path/to/.wownero/lmdb/` + +Quick fix with ACLs: +```bash +sudo apt install acl +sudo setfacl -m u:wowexplorer:rx /home/jw +sudo setfacl -m u:wowexplorer:rx /home/jw/.wownero +sudo setfacl -m u:wowexplorer:rwx /home/jw/.wownero/lmdb +sudo setfacl -m u:wowexplorer:rw /home/jw/.wownero/lmdb/data.mdb +sudo setfacl -m u:wowexplorer:rw /home/jw/.wownero/lmdb/lock.mdb +sudo systemctl restart wowexplorer +``` + ### 4. Enable and start the service ```bash