FHS F4.3: service enable flags + samba/connman/tailscale/cron state

Wider Class D batch. Every state directory referenced by a systemd
unit or runtime script now lives at an Arch-conventional path with a
bridge symlink into /storage:

service enable/disable flags
  /storage/.cache/services -> /var/lib/archr/services
  ConsumerS: 099-networkservices, archr-report-stats.timer, and the
  12 unit files that gate themselves on .conf / .disabled sentinels
  (avahi-daemon, avahi-defaults, sshd, nmbd, smbd, simple-http-server,
  syncthing, tailscaled, zerotier-one, cron, cron-defaults). The
  systemd-scripts/usercache-setup migration helper updated too.

samba passdb
  /storage/.cache/samba -> /var/lib/samba/private (Arch standard).
  smb.conf passdb line + 007-rootpw boot init script updated.

connman + wireguard
  /storage/.cache/connman -> /var/lib/connman
  /storage/.config/wireguard -> /etc/wireguard (vpn_storagedir)
  Bridges installed by the connman package; connman-setup script
  follows the bridge.

tailscale
  /storage/.cache/tailscale -> /var/lib/tailscale.
  tailscaled --state= flag flipped to the FHS path; bridge in archr
  meta-package.

cron
  /storage/.cache/cron -> /var/spool/cron (Arch convention; busybox
  crond reads spool/<user>). cron.service ExecStartPre updated.

archr meta-package now ships seven Class D bridge symlinks alongside
the five Class C bridges from earlier phases. Everything else stays
on the storage overlay; nothing on disk moved.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

projects/ArchR/packages/archr/autostart/007-rootpw

@@ -7,10 +7,10 @@
 
 tocon "Setting root password..."
 
-if [ ! -d "/storage/.cache/samba" ]
+if [ ! -d "/var/lib/samba/private" ]
 then
-  mkdir -p /storage/.cache/samba
-  touch /storage/.cache/samba/smbpasswd
+  mkdir -p /var/lib/samba/private
+  touch /var/lib/samba/private/smbpasswd
 fi
 
 ROOTPASS=$(get_setting root.password)

projects/ArchR/packages/archr/autostart/099-networkservices

@@ -12,15 +12,15 @@ do
   source ${SERVICE}
 
 
-  if [ ! -d "/storage/.cache/services" ]
+  if [ ! -d "/var/lib/archr/services" ]
   then
-    mkdir -p "/storage/.cache/services"
+    mkdir -p "/var/lib/archr/services"
   fi
 
   if [ -n "${CONF}" ] && \
-     [ -e "/storage/.cache/services/${CONF}" ]
+     [ -e "/var/lib/archr/services/${CONF}" ]
   then
-    rm -f "/storage/.cache/services/${CONF}"
+    rm -f "/var/lib/archr/services/${CONF}"
   fi
 
   statemgr() {
@@ -32,7 +32,7 @@ do
 
   case "$STATE" in
     "1")
-      touch "/storage/.cache/services/${CONF}"
+      touch "/var/lib/archr/services/${CONF}"
       statemgr start
     ;;
     *)

projects/ArchR/packages/archr/package.mk

@@ -62,6 +62,20 @@ EOF
   # pre-boot bootloader scripts know about and cannot move; userland
   # tooling reads/writes through the FHS bridge.
   ln -sf /storage/.update                  ${INSTALL}/var/cache/archr/update
+
+  # State directories for runtime data the system writes back to the
+  # storage overlay. Same bridge pattern, just under /var/lib instead
+  # of /var/cache.
+  mkdir -p ${INSTALL}/var/lib/archr
+  ln -sf /storage/.cache/services          ${INSTALL}/var/lib/archr/services
+  # samba passdb at the Arch-standard /var/lib/samba/private path.
+  mkdir -p ${INSTALL}/var/lib/samba
+  ln -sf /storage/.cache/samba             ${INSTALL}/var/lib/samba/private
+  # tailscale daemon state (Arch convention).
+  ln -sf /storage/.cache/tailscale         ${INSTALL}/var/lib/tailscale
+  # cron spool (Arch convention; busybox crond walks the subtree).
+  mkdir -p ${INSTALL}/var/spool
+  ln -sf /storage/.cache/cron              ${INSTALL}/var/spool/cron
 }
 
 post_install() {

projects/ArchR/packages/archr/sources/scripts/backuptool

@@ -23,7 +23,7 @@ DEFAULT=(
     /storage/.config/fancontrol.conf
     /storage/.config/backuptool.conf
     /var/lib/bluetooth/*
-    /storage/.cache/connman*
+    /var/lib/connman*
     /storage/.config/system/configs/system.cfg
     /storage/.config/ppsspp/*
     /storage/.config/retroarch/*

projects/ArchR/packages/archr/system.d/archr-report-stats.timer

@@ -1,6 +1,6 @@
 [Unit]
 Description=Timer to report anonymous ArchR install statistics
-ConditionPathExists=/storage/.cache/services/stats.enabled
+ConditionPathExists=/var/lib/archr/services/stats.enabled
 
 [Timer]
 OnBootSec=5min

projects/ArchR/packages/network/avahi/system.d/avahi-daemon.service

@@ -3,7 +3,7 @@ Description=Avahi Daemon
 After=network.target avahi-defaults.service
 RequiresMountsFor=/storage
 Requires=avahi-defaults.service
-ConditionPathExists=/storage/.cache/services/avahi.conf
+ConditionPathExists=/var/lib/archr/services/avahi.conf
 
 [Service]
 Restart=on-failure

projects/ArchR/packages/network/avahi/system.d/avahi-defaults.service

@@ -3,10 +3,10 @@ Description=Avahi defaults
 After=local-fs.target
 RequiresMountsFor=/storage
 
-ConditionPathExists=!/storage/.cache/services/avahi.conf
-ConditionPathExists=!/storage/.cache/services/avahi.disabled
+ConditionPathExists=!/var/lib/archr/services/avahi.conf
+ConditionPathExists=!/var/lib/archr/services/avahi.disabled
 
 [Service]
 Type=oneshot
-ExecStart=/bin/sh -c 'cp /usr/share/services/avahi.conf /storage/.cache/services/'
+ExecStart=/bin/sh -c 'cp /usr/share/services/avahi.conf /var/lib/archr/services/'
 RemainAfterExit=yes

projects/ArchR/packages/network/connman/package.mk

@@ -52,8 +52,8 @@ else
   PKG_CONFIGURE_OPTS_TARGET+=" --disable-wireguard"
 fi
 
-PKG_MAKE_OPTS_TARGET="storagedir=/storage/.cache/connman \
-                      vpn_storagedir=/storage/.config/wireguard \
+PKG_MAKE_OPTS_TARGET="storagedir=/var/lib/connman \
+                      vpn_storagedir=/etc/wireguard \
                       statedir=/run/connman"
 
 post_makeinstall_target() {
@@ -81,6 +81,13 @@ post_makeinstall_target() {
 
   mkdir -p ${INSTALL}/usr/share/connman/
     cp ${PKG_DIR}/config/settings ${INSTALL}/usr/share/connman/
+
+  # FHS bridges: connman storagedir baked at /var/lib/connman, wireguard
+  # vpn_storagedir at /etc/wireguard (both Arch conventions). Bridges
+  # land at the storage overlay so connections and tunnels persist.
+  mkdir -p ${INSTALL}/var/lib
+  ln -sf /storage/.cache/connman ${INSTALL}/var/lib/connman
+  ln -sf /storage/.config/wireguard ${INSTALL}/etc/wireguard
 }
 
 post_install() {

projects/ArchR/packages/network/connman/scripts/connman-setup

@@ -4,9 +4,9 @@
 # Copyright (C) 2009-2014 Stephan Raue (stephan@openelec.tv)
 
 # creating initial settings file
-  if [ ! -f /storage/.cache/connman/settings ]; then
-    mkdir -p /storage/.cache/connman
-      cp /usr/share/connman/settings /storage/.cache/connman
+  if [ ! -f /var/lib/connman/settings ]; then
+    mkdir -p /var/lib/connman
+      cp /usr/share/connman/settings /var/lib/connman
   fi
 
 # set variable for connman main.conf location

projects/ArchR/packages/network/openssh/system.d/sshd.service

@@ -3,11 +3,11 @@ Description=OpenSSH server daemon
 After=network.target
 RequiresMountsFor=/storage
 ConditionKernelCommandLine=|ssh
-ConditionPathExists=|/storage/.cache/services/sshd.conf
+ConditionPathExists=|/var/lib/archr/services/sshd.conf
 
 [Service]
 Restart=on-failure
-EnvironmentFile=-/storage/.cache/services/sshd.conf
+EnvironmentFile=-/var/lib/archr/services/sshd.conf
 ExecStartPre=-/bin/sh -c 'mkdir -p /var/lib/sshd'
 ExecStartPre=/usr/bin/ssh-keygen -A
 ExecStartPre=-/bin/sh -c 'chmod 600 /var/lib/sshd/ssh_host_*'

projects/ArchR/packages/network/samba/config/smb.conf

@@ -20,7 +20,7 @@
   load printers = no
   enable core files = no
   passdb backend = smbpasswd
-  smb passwd file = /storage/.cache/samba/smbpasswd
+  smb passwd file = /var/lib/samba/private/smbpasswd
   smb encrypt = disabled
   fruit:model = Xserve
 

projects/ArchR/packages/network/samba/system.d/nmbd.service

@@ -3,7 +3,7 @@ Description=Samba NMB Daemon
 Wants=network-online.target samba-config.service
 After=network-online.target samba-config.service
 RequiresMountsFor=/storage
-ConditionPathExists=!/storage/.cache/services/samba.disabled
+ConditionPathExists=!/var/lib/archr/services/samba.disabled
 ConditionPathExists=/run/samba/smb.conf
 
 [Service]

projects/ArchR/packages/network/samba/system.d/smbd.service

@@ -3,7 +3,7 @@ Description=Samba SMB Daemon
 Wants=network-online.target nmbd.service avahi-daemon.service
 After=network-online.target nmbd.service avahi-daemon.service
 RequiresMountsFor=/storage
-ConditionPathExists=!/storage/.cache/services/samba.disabled
+ConditionPathExists=!/var/lib/archr/services/samba.disabled
 ConditionPathExists=/run/samba/smb.conf
 
 [Service]

projects/ArchR/packages/network/simple-http-server/system.d/simple-http-server.service

@@ -3,7 +3,7 @@ Description=simple-http-server
 Wants=network-pre.target
 After=network-pre.target
 RequiresMountsFor=/storage
-ConditionPathExists=/storage/.cache/services/simplehttp.conf
+ConditionPathExists=/var/lib/archr/services/simplehttp.conf
 
 [Service]
 ExecStart=/usr/bin/bash -c "source /etc/profile.d/001-functions && /usr/bin/simple-http-server -i -p 80 -a root:$(get_setting root.password) -s -u /storage"

projects/ArchR/packages/network/syncthing/system.d/syncthing.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=Start SyncThing
 After=archr.service
-ConditionPathExists=/storage/.cache/services/syncthing.conf
+ConditionPathExists=/var/lib/archr/services/syncthing.conf
 
 [Service]
 Type=simple

projects/ArchR/packages/network/tailscale/system.d/tailscaled.service

@@ -4,12 +4,12 @@ Documentation=https://tailscale.com/kb/
 Wants=network-pre.target
 After=network-pre.target systemd-resolved.service
 RequiresMountsFor=/storage
-ConditionPathExists=/storage/.cache/services/tailscaled.conf
+ConditionPathExists=/var/lib/archr/services/tailscaled.conf
 
 [Service]
 EnvironmentFile=/storage/.config/tailscaled.defaults
 ExecStartPre=/usr/sbin/tailscaled --cleanup
-ExecStart=/usr/sbin/tailscaled --state=/storage/.cache/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port $PORT $FLAGS
+ExecStart=/usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port $PORT $FLAGS
 ExecStopPost=/usr/sbin/tailscaled --cleanup
 
 Restart=on-failure

projects/ArchR/packages/network/zerotier-one/system.d/zerotier-one.service

@@ -3,7 +3,7 @@ Description=zerotier-one
 Wants=network-pre.target
 After=network-pre.target
 RequiresMountsFor=/storage
-ConditionPathExists=/storage/.cache/services/zerotier.conf
+ConditionPathExists=/var/lib/archr/services/zerotier.conf
 
 [Service]
 ExecStart=/usr/sbin/zerotier-one /storage/.config/zerotier/

projects/ArchR/packages/sysutils/busybox/system.d.opt/cron-defaults.service

@@ -3,10 +3,10 @@ Description=Cron defaults
 After=local-fs.target
 RequiresMountsFor=/storage
 
-ConditionPathExists=!/storage/.cache/services/crond.conf
-ConditionPathExists=!/storage/.cache/services/crond.disabled
+ConditionPathExists=!/var/lib/archr/services/crond.conf
+ConditionPathExists=!/var/lib/archr/services/crond.disabled
 
 [Service]
 Type=oneshot
-ExecStart=/bin/sh -c 'cp /usr/share/services/crond.conf /storage/.cache/services/'
+ExecStart=/bin/sh -c 'cp /usr/share/services/crond.conf /var/lib/archr/services/'
 RemainAfterExit=yes

projects/ArchR/packages/sysutils/busybox/system.d.opt/cron.service

@@ -4,10 +4,10 @@ After=cron-defaults.service
 RequiresMountsFor=/storage
 Requires=cron-defaults.service
 
-ConditionPathExists=/storage/.cache/services/crond.conf
+ConditionPathExists=/var/lib/archr/services/crond.conf
 
 [Service]
-ExecStartPre=/bin/mkdir -p /storage/.cache/cron/crontabs
+ExecStartPre=/bin/mkdir -p /var/spool/cron/crontabs
 ExecStart=/sbin/crond -f -S
 KillMode=process
 TimeoutStopSec=1s

projects/ArchR/packages/sysutils/systemd/scripts/usercache-setup

@@ -3,8 +3,8 @@
 # SPDX-License-Identifier: GPL-2.0
 # Copyright (C) 2017-present Team LibreELEC (https://libreelec.tv)
 
-# Fix bug in older versions creating file /storage/.cache/services
-[ -f /storage/.cache/services ] && rm /storage/.cache/services && mkdir -p /storage/.cache/services
+# Fix bug in older versions creating file /var/lib/archr/services
+[ -f /var/lib/archr/services ] && rm /var/lib/archr/services && mkdir -p /var/lib/archr/services
 
 # Copy cache files, but don't overwrite
 false | cp -iRp /usr/cache/* /storage/.cache/ &>/dev/null