fix(deploy): drop ReadWritePaths that conflicts with PrivateTmp

[acooks]

Problem

deploy/jittertrap.service and deploy/jittertrap-monitor.service both set:

PrivateTmp=yes
...
ReadWritePaths=/tmp/jittertrap

These conflict. PrivateTmp=yes gives the unit a fresh, private /tmp, so the host /tmp/jittertrap that ReadWritePaths bind-mounts doesn't exist in the unit's mount namespace. The service fails to start:

Failed to set up mount namespacing: /tmp/jittertrap: No such file or directory
Failed at step NAMESPACE spawning /usr/bin/jt-server: No such file or directory
jittertrap.service: Main process exited, code=exited, status=226/NAMESPACE

(Reproduced on a fresh Ubuntu deployment.)

Fix

Remove ReadWritePaths=/tmp/jittertrap from both units. PrivateTmp=yes already provides a writable, isolated /tmp, so it's redundant — pcap output under /tmp lands in the unit's private tmp.

Note: this keeps the PrivateTmp hardening. If pcap capture expects /tmp/jittertrap to pre-exist, jt-server should create it, or a RuntimeDirectory=jittertrap (under /run) could be used instead — happy to adjust to whichever you prefer.

Testing

With this change the unit starts cleanly (systemctl is-active → active) on a fresh Ubuntu 26.04 host; previously it crash-looped on 226/NAMESPACE.

🤖 Generated with Claude Code