Add configurable ownership and permission defaults for shared DH
parameter directories and files.
Set shared DH parameter defaults to root:root, directory mode 0755, and file
mode 0644 so non-root TLS services can traverse the directory and read DH
parameter files.
Enforce configured ownership and modes after synchronization and document the
security boundary between public DH parameters and TLS private keys.
Validate configured systemd units before applying service-specific DH
parameter synchronization.
Synchronize per-service DH parameters before restarting active units. Query
system-wide and per-user systemd managers with LoadState, ActiveState,
SubState, and Type.
Restart active units, start inactive or failed Type=oneshot units, and leave
inactive or failed non-oneshot units without a service action. Skip missing
units, unavailable user managers, and invalid or incomplete service
definitions without creating misleading synchronization messages.
Add robust error handling for DH parameter generation, permission changes,
directory creation, global synchronization, and temporary file cleanup.
sduesterhaupt