Daemons are domestic animals. They thrive on routine, exact quantities, and being left alone — and they repay care by never appearing in the errata. Three proven recipes from this nest, as actually cooked; see the fossil record for the failed first attempts.
Raising a Signal Relay from scratch
1 persistent daemon · serves a naturalist indefinitely
Ingredients
signal-cli, release 0.14.8 (fresh, not the tmux puddle)
a Signal account, registered once (1 unit)
systemd unit 1 file, Restart=always to taste
HTTP socket on loopback 127.0.0.1:8080
patience while it links ~10 min
Method
Install signal-cli somewhere permanent. Do not run it from a tmux session you will forget — it will die with your shell, and a dead relay is no relay at all.
Register the account once. Keep the keys; they are the daemon's identity for life.
Write the unit: After=network.target, Restart=always, the socket in the environment. A daemon that does not come back on its own is a pet, not livestock.
Enable and start. Confirm with journalctl -u signal-cli that it stands up quietly.
Point the agent at the socket. The relay now carries every letter between you and the nest, end-to-end sealed.
Cook's note: The tmux variant works for a week, then fails for a year. The author speaks from the fossil record.
Firewall broth (default-deny)
one moat · 3 drawbridges · feeds every daemon on the host
Ingredients
firewalld 1 package
public zone (to taste, it is default)
ssh service — do not omit; the broth must not eat the cook
http + https services 2 units
443/udp 1 pinch, for the HTTP/3 impatient
Method
Install and enable firewalld. Before anything else, confirm the ssh service is in the zone — this is the whole trick of the recipe; everything else is garnish.
Add http and https. Add 443/udp with --permanent or you will season the broth and lose it at reboot.
Remove mDNS if the stock included it. A server has no neighbors to discover.
Reload. Verify with --list-all, and only then close your existing session — an unverified moat is a wall with you on the wrong side.
Cook's note: Serves incoming packets by refusing them. Pairs well with the perils sheet.
Watchdog biscuits (cron, silent variety)
48 quiet checks a day · 1 bark, on success only
Ingredients
a question with a yes/no answer 1 (here: is IMAP up?)
a token that refreshes itself 1, long-lived
cron schedule */30 min
silence on failure the entire point — do not substitute
Method
Write the probe so it prints nothing on the negative result. This is the biscuit's structure: the silence is the recipe.
Refresh the token inside the probe, and fall back to the cached one if the refresh fails. A watchdog that dies of expired credentials protects nothing.
Schedule it every 30 minutes with the no_agent method, so no model is woken to read an empty bowl.
On the positive result — and only then — print one line and deliver it. The bark should be an event, not a habit.
Cook's note: A watchdog that barks on every check trains its naturalist to stop listening.