guardctrl.md

@@ -6,15 +6,34 @@ Each guardian node is handled by a systemd "unit", which describes how the proce
 
 ## host setup
 
-The needed components are part of the `guardctrl` package (which is available through the [LIGO Debian apt archives](http://apt.ligo-wa.caltech.edu/debian/):
+The `guardctrl` package is available through the [LIGO Debian apt archives](http://apt.ligo-wa.caltech.edu/debian/), so once that archive needs to be enabled we install the package:
 ```shell
 # apt install guardctrl
 ```
 
 guardctrl assumes a systemd --user instance.  For the LIGO site installations we therefore create a `guardian` user:
 ```shell
-# adduser --uid 1010 --ingroup controls --disabled-password guardian
+# adduser --gecos '' --uid 1010 --ingroup controls --disabled-password guardian
 ```
 We use `uid=1010` to not collide with any of the other standard system users, and we add it to the `controls` group so that it can write archive and channel info to locations owned by the controls group.
 
+### guardctrl setup
+
+The `guardctrl` interface knows that it's running as the correct user by the presence of a `~/.guardctrl-home` file.  Touch this file in the `guardian` user home directory:
+```shell
+# su guardian -c "touch ~/.guardctrl-home"
+```
+
+The guardian systemd service unit expects an `/etc/guardian/local-env` environment file to exist, for providing any needed environment variables to the supervised guardian processes.  Here's an example of the file for H1 at LHO:
+```shell
+# cat /etc/guardian/local-env
+IFO=H1
+SITE=LHO
+GUARD_CHANFILE=/opt/rtcds/userapps/release/cds/h1/daqfiles/ini/H1EDCU_GRD.ini
+GUARD_ARCHIVE_ROOT=/ligo/cds/lho/h1/guardian/archive
+NDSSERVER=h1nds0:8088,h1nds1:8088
+```
+
+### SSH interface setup
+
 /opt/rtcds/userapps/release/cds/h1/daqfiles/ini/H1EDCU_GRD.ini
\ No newline at end of file