From 1925676fc95b8c70cbf93eb885af510c188b3865 Mon Sep 17 00:00:00 2001
From: Qiufeng <qiufengawa@users.noreply.github.com>
Date: Wed, 2 Sep 2026 14:06:49 +0800
Subject: [PATCH] fix: allow netlink for wildcard listener startup

---
 package.json                     | 2 +-
 scripts/test-installer.sh        | 2 ++
 systemd/tallynote-update.service | 4 +++-
 systemd/tallynote.service        | 4 +++-
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index addd2c8..93e8c8c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "tallynote",
-  "version": "1.1.9",
+  "version": "1.1.10",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@9.0.6",
diff --git a/scripts/test-installer.sh b/scripts/test-installer.sh
index fd1f01a..30f8d0f 100755
--- a/scripts/test-installer.sh
+++ b/scripts/test-installer.sh
@@ -2,6 +2,8 @@
 set -Eeuo pipefail
 root=$(cd "$(dirname "$0")/.." && pwd)
 bash -n "$root/install.sh" "$root/scripts/tallynote-update.sh"
+grep -Eq '^RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK$' "$root/systemd/tallynote.service"
+grep -Eq '^RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK$' "$root/systemd/tallynote-update.service"
 output=$(bash "$root/install.sh" --dry-run --release-base-url https://releases.example.test/releases)
 grep -q 'dry-run' <<<"$output"
 grep -q '\[阶段\] 检查运行环境' <<<"$output"
diff --git a/systemd/tallynote-update.service b/systemd/tallynote-update.service
index 3ec011a..9f4230a 100644
--- a/systemd/tallynote-update.service
+++ b/systemd/tallynote-update.service
@@ -15,7 +15,9 @@ Environment=PATH=/usr/sbin:/usr/bin:/sbin:/bin
 NoNewPrivileges=true
 CapabilityBoundingSet=
 AmbientCapabilities=
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+# Keep the updater compatible with the same Node/libuv interface discovery
+# path while retaining an explicit socket-family allowlist.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 PrivateTmp=true
 PrivateDevices=true
 ProtectHome=true
diff --git a/systemd/tallynote.service b/systemd/tallynote.service
index a6de39f..0d01755 100644
--- a/systemd/tallynote.service
+++ b/systemd/tallynote.service
@@ -20,7 +20,9 @@ ProtectSystem=strict
 InaccessiblePaths=/opt/tallynote/.update-work
 ProtectHome=true
 PrivateDevices=true
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+# Fastify logs the addresses of wildcard listeners. Node's libuv uses the
+# Linux netlink family while enumerating interfaces for that log message.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectKernelLogs=true