From 25780cd6e8f2cd44ec76f690ececc9aab5ca3767 Mon Sep 17 00:00:00 2001
From: tke <tobias.kessels@certbw.de>
Date: Thu, 24 Sep 2026 13:12:18 +0200
Subject: [PATCH] fix(proxy): unit file carries DISPLAY +
 DBUS_SESSION_BUS_ADDRESS

Lockout notifications need a session path; systemd user services start with an
empty Environment, which made notify-send silently unreachable. Installer now
writes the current DISPLAY and the user-bus address (XDG runtime dir) into the
unit; deploy + daemon-reload + restart applied live and verified (7 listeners,
routed profiles answer 200).
---
 scripts/proxy/install.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/proxy/install.js b/scripts/proxy/install.js
index b00ae05..41bbc17 100644
--- a/scripts/proxy/install.js
+++ b/scripts/proxy/install.js
@@ -450,7 +450,7 @@ function sectionUnit() {
         if (cand && !fs.realpathSync(cand).includes('/.hermes/')) nodeBin = cand;
     }
     if (!nodeBin) nodeBin = process.execPath;
-    const want = `[Unit]\nDescription=Local Proxy Bridge (Keyring Auth)\nAfter=network.target\n\n[Service]\nType=simple\nExecStart=${nodeBin} ${BRIDGE_DIR}/bridge.js\nRestart=on-failure\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`;
+    const want = `[Unit]\nDescription=Local Proxy Bridge (Keyring Auth)\nAfter=network.target\n\n[Service]\nType=simple\nEnvironment=DISPLAY=${process.env.DISPLAY || ':0'}\nEnvironment=DBUS_SESSION_BUS_ADDRESS=${process.env.DBUS_SESSION_BUS_ADDRESS || `unix:path=/run/user/${process.getuid()}/bus`}\nExecStart=${nodeBin} ${BRIDGE_DIR}/bridge.js\nRestart=on-failure\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`;
     let current = null;
     try { current = fs.readFileSync(unitPath, 'utf8'); } catch {}
     if (current === want) {