Switching RAUC’s streaming mTLS client key from a file path to a PKCS#11 URI produced a one-line error with no obvious cause. The real problem was not the module path, not the engine, and not a missing PIN — it was the sandbox user’s group membership and what tpm2-pkcs11 needs to initialise.
No OE recipe for Telegraf exists upstream. What looked like a straightforward packaging task turned into a Go linker collision, a PIE/CGO conflict, and a credential problem that ruled out the obvious solution entirely.
Part 1 got OTBR running as a non-root user with three capabilities. Part 2 covers the hardening block in the service file — what each directive does, why one had to be an exception, and how to use systemd-analyze security as a decision tool rather than a score to chase. Part 2 of 2.
OpenThread Border Router assumes it runs as root. Getting it down to a least-privilege non-root user means figuring out exactly what it needs — which turned out to be a source code problem, not a trial-and-error problem. Part 1 of 2.