Integration of afuse user-level automounter with sshfs as a systemd service spawned from login for local users

Question

Edit 2020: I've been using the systemd-answer posted below for several years now, and am quite happy with it.

To facilitate working with remote files, I setup afuse with sshfs to run from .bashrc of local users. It works, after bash init all remote trees from ~/.ssh/config/ are mounted on-demand under ~/scp/, with correct access rights/restrictions.

This is currently in (a file, that is sourced from) .bashrc:

exists(){ [[ ${1:0:1} == "/" ]] && { test -f $1 || test -d $1; } \
          || command -v $1 >/dev/null 2>&1;                        }

# Run an afuse process as daemon
if pgrep -u $USER -f "afuse.*$USER/scp" >/dev/null ; then
  echo "afuse/sshfs already running"
else
  exists afuse && exists sshfs && exists $HOME/scp \
  && export TAfuseX=$(mktemp --suffix=__afuse) && chmod u+x "$TAfuseX" \
  && echo -e "#!/bin/sh\ngrep '^Host ..' ~/.ssh/co* |colrm 1 5" > $TAfuseX \
  && echo "running afuse/sshfs with nohup" \
  && nohup afuse -o mount_template="sshfs %r:/ %m" \
                 -o unmount_template="fusermount -u -z %m" \
                 -o populate_root_command=$TAfuseX \
                 ~/scp 2>&1 > ~/afuse.log
fi

(The above already incorporates a helpful hint from @sato-katsura)

The above makes sure, it normally runs until machine-shutdown. It is independent of X stops/starts. In case of afuse crash (has never been observed by me), the next shell re-spawns it.

Do you see any useful optimizations, pitfalls, or have other hints, even before migrating this to systemd? How would you wrap that into a systemd user unit?

Answer 1

I have been using this systemd user service unit definition file for a few years now: afuse.service

[Unit]
Description="SSHFS via Afuse automounter"
AssertPathExists=%h/scp/
AssertFileIsExecutable=/usr/bin/afuse
AssertFileIsExecutable=/usr/bin/sshfs

[Service]
Type=forking
WorkingDirectory=%h/scp
ExecStart=/usr/bin/afuse \
    -o fsname=AutoSCP \
    -o timeout=300 \
    -o auto_unmount \
    -o flushwrites \
    -o mount_template="sshfs -o ServerAliveInterval=10 -o reconnect %%r:/ %%m" \
    -o unmount_template="fusermount -u -z %%m" .
Restart=always
PrivateTmp=true
#NoNewPrivileges=true  <- That option breaks this unit, why?

[Install]
WantedBy=default.target

Create the file afuse.service with above contents in:

• ~/.config/systemd/user/ if installing only for you
• /etc/systemd/user/ if installing for all local users

Install this service with:

mkdir ~/scp  # Or Home Directories of all existing users + /etc/skel/ 
systemctl --user daemon-reload   # If root, then omit '--user'
# If enabling only for the current user:
systemctl --user enable afuse.service
# If enabling for all users, execute as root:
# systemctl --user --global enable service
systemctl --user start afuse.service

If needed, you can configure your SSH-AGENT to place the socket not in /tmp/..., but somewhere under ~, then this service ought to be able to use the agent. (If there is demand, I could add exact steps for that too, @dirdi)