Of course, dropping privileges breaks with systemd sockets

dnscrypt-proxy/example-dnscrypt-proxy.toml

@@ -46,7 +46,9 @@ max_clients = 250
 ## The first one will keep root privileges, but is only a supervisor, that does nothing
 ## except create the sockets, manage the service, and restart it if it crashes.
 ## The second process is the service itself, and that one will always run as a different
-## user. Note: this feature is currently unsupported on Windows.
+## user.
+## Note (1): this feature is currently unsupported on Windows.
+## Note (2): this feature is not compatible with systemd socket activation.
 
 # username = 'nobody'
 

dnscrypt-proxy/privilege_others.go

@@ -38,6 +38,8 @@ func (proxy *Proxy) dropPrivilege(userStr string, fds []*os.File) {
 		dlog.Fatal(err)
 	}
 
+	SystemDNotify()
+
 	args = args[1:]
 	args = append(args, "-child")
 

dnscrypt-proxy/proxy.go

@@ -153,7 +153,9 @@ func (proxy *Proxy) StartProxy() {
 	liveServers, err := proxy.serversInfo.refresh(proxy)
 	if liveServers > 0 {
 		dlog.Noticef("dnscrypt-proxy is ready - live servers: %d", liveServers)
-		SystemDNotify()
+		if !proxy.child {
+			SystemDNotify()
+		}
 	} else if err != nil {
 		dlog.Error(err)
 		dlog.Notice("dnscrypt-proxy is waiting for at least one server to be reachable")