Signed-off-by: Jakob Borg <jakob@kastelo.net>

Signed-off-by: Jakob Borg <jakob@kastelo.net>

* infrastructure:
  refactor: remove unused support for Azure blob stores
  fix(stdiscosrv): must not modify database entries in-place

…anagers (#10558)

gui: Add id and name to Stay logged in checkbox for password manager support

Signed-off-by: epifeny <epifeny@users.noreply.github.com>
Co-authored-by: epifeny <epifeny@users.noreply.github.com>

…maintenance, query last maintenance time (#10565)

Also adds a method to query the last database maintenance time.

Signed-off-by: Tommy van der Vorst <tommy@pixelspark.nl>
Co-authored-by: Jakob Borg <jakob@kastelo.net>

…10566)

Signed-off-by: steadytao <mail@steadytao.com>
Signed-off-by: Jakob Borg <jakob@kastelo.net>
Co-authored-by: Jakob Borg <jakob@kastelo.net>

Signed-off-by: Michael Wang <michael19920327@gmail.com>

Update the existing minimal service hardening with a comprehensive
sandbox to minimize blast damage from service compromise.

Please see the detailed code comments for an explanation of what is
sandboxed.

Roughly, we limit: /dev, /proc, /tmp, AF_UNIX, AF_PACKET, execution of
_any_ binary other than "/usr/bin/syncthing" and "/usr/lib",
uncommon syscalls plus io_uring, tons of kernel internals and more. We
also enable a bunch of kernel namespaces for isolation.

In short, pretty much everything is sandboxed and specifically tuned for
syncthing's behavior.

Sadly, we cannot use ProtectSystem=strict by default because we don't
know the directories that the user will be sharing. There's a big
comment block explaining how users can enable it for "extra credit". :)

If the user did add the following options as the unit file recommends:

- ProtectSystem=strict
- ReadWritePaths=/my/shared/dir1 /my/shared/dir2
- ProtectHome=true

Then the user would end up with a *far* more comprehensive sandbox than
anything a container runtime (like Docker/Podman/whatever) would
provide.

Much (but not all) of these options could be ported to the
user/syncthing.service file, BUT it would require work. Systemd does not
allow all of these options to be used with the user service manager,
although using PrivateUsers=true would help with most of it.

I cannot justify the time investment to develop, audit and test the
port to user/syncthing.service so I leave that for interested
contributors.

Tested on Debian Trixie (13) with the following versions:
- v1.29.5, Linux (64-bit Intel/AMD)
- latest HEAD (d3d3fc2 committed on Mon Oct 6 01:42:58 2025)

Signed-off-by: Val Markovic <val@markovic.io>

WaitGroup.Go and built-in gomaxprocs handling.

Signed-off-by: Jakob Borg <jakob@kastelo.net>