tb-phone — setup notes

Helper files for a small Linux arm64 phone (systemd), split into two topics: Syncthing for file sync and Netbird as the VPN the sync traffic runs through. Both folders hold the source of truth for scripts and unit files; the device gets its copies from explicit install commands, never by copying the whole folder over.

Folder	What it is
syncthing/	Syncthing client as a system unit running as uid 100000, plus a nightly self-updater (syncthing-update.sh + .service + .timer).
netbird/	Netbird client installed from the upstream arm64 binary (netbird service install), plus a nightly self-updater and an optional burst mode that only raises the tunnel around a sync.
dnd/	Nightly Do Not Disturb: two system units (like netbird/syncthing) that call dconf write directly, with the session bus address of defaultuser set via Environment=.

Each folder has its own README with the full first-install walkthrough, the file → target-path table and the exact install / systemctl commands. Read those before touching a device; this file is only the overview.

syncthing

Continuous file synchronisation between the phone and the other machines. Runs permanently in the background, serves the REST API/GUI on 127.0.0.1:8384, and keeps its config plus database in the home of uid 100000 (/home/defaultuser/.local/state/syncthing/ on Syncthing 1.27+).

The unit runs syncthing serve --no-browser --no-restart with Restart=on-failure, so systemd owns restarts and all output goes to the journal. syncthing-update.timer checks GitHub daily at 02:00 and swaps the binary in /usr/bin/syncthing only when a newer stable release exists.

netbird

The WireGuard-based mesh VPN the device uses to reach the sync peers without exposing anything publicly. Installed as a normal Netbird client service (netbird.service, created by netbird service install), binary in /usr/bin/netbird.

Two extra pieces sit on top:

• netbird-update.sh + netbird-update.service + netbird-update.timer — same pattern as the Syncthing updater, daily at 01:00. Stop service, replace binary, start, wait for the socket, netbird up.
• netbird-burst.sh + netbird-burst.service + netbird-burst.timer — optional, see below.

The burst mode is optional

netbird-burst.sh, netbird-burst.service and netbird-burst.timer are only needed if the Netbird daemon should not run permanently, but be started every 15 minutes, kept up just long enough for a Syncthing sync window, and shut down again afterwards. If you are fine with the tunnel being up all the time, skip all three files — nothing else depends on them, and the rest of the setup works unchanged.

How the burst window is meant to work:

1. netbird-burst.timer fires netbird-burst.service (Type=oneshot, ExecStart=/usr/local/bin/netbird-burst.sh) — 2 min after boot, then 15 min after the previous run finished, so two runs can never overlap.
2. The script checks that Syncthing is running and reachable (starting it if needed), reading the API key out of the Syncthing config.xml — that is why the burst files live next to the Syncthing setup and why ST_SERVICE and CONFIG in the script must match the device.
3. It starts netbird, waits for at least one Syncthing connection (CONNECT_TIMEOUT), then polls the folders and the outgoing traffic counter until nothing is transferring any more (SETTLE seconds of quiet).
4. It stops netbird again through a trap on exit, so the tunnel is down for the remaining ~15 minutes — the point of the whole exercise: VPN only up while data actually moves. MAX_RUNTIME=3600 caps a single window at one hour.

Consequence to keep in mind: while the burst timer is active, the tunnel is down most of the time, so anything else that expects Netbird to be reachable (SSH from outside, a monitoring probe, a second sync tool) has to tolerate gaps of roughly 15 minutes. Switch the burst timer off (systemctl disable --now netbird-burst.timer, systemctl enable --now netbird) if the device should simply stay online.

Install order on a fresh device: Syncthing first (binary, unit, GUI/device enrolment), then Netbird (binary, netbird service install/start, netbird up --setup-key), then the update timers, and last the burst files — but only if you actually want the 15-minute window.

dnd

Sailfish OS itself has no schedule for Do not disturb. install-dnd-timer.sh installs two system units (/etc/systemd/system/dnd-on.timer / dnd-off.timer, like netbird and syncthing) that flip the Top-menu switch at 23:00 and 06:30 with a plain dconf write. Because dconf only reaches defaultuser's database through defaultuser's D-Bus session bus — and a system unit starts without DBUS_SESSION_BUS_ADDRESS — each service carries the address that the phone actually uses, unix:path=/run/user/100000/dbus/user_bus_socket (SFOS runs the session bus as dbus-daemon, not at the usual /run/user/<uid>/bus). The installer detects and verifies that address on the device before installing. See dnd/README.md.