sir_melonchenandClaude Opus 5.5
346d24cb34
ci / Protobuf (push) Successful in 16s
ci / Web (lint, test, audit, build) (push) Successful in 2m53s
ci / Shell and licence headers (push) Successful in 23s
ci / Release build (dry run) (push) Successful in 3m46s
ci / Integration (real BIND and Kea) (push) Successful in 2m47s
ci / Development environment (compose) (push) Successful in 18s
install / Installation (debian:13) (push) Successful in 6m59s
ci / Go (lint, test, vuln) (push) Successful in 6m4s
ci / End-to-end (server, agents, BIND, Kea) (push) Successful in 3m50s
install / Installation (debian:12) (push) Successful in 6m17s
install / Installation (ubuntu:22.04) (push) Successful in 6m31s
install / Installation (rocky:9) (push) Successful in 9m53s
install / Installation (ubuntu:24.04) (push) Successful in 6m38s
release / release (push) Successful in 4m15s
On the user's server the check reported "socket: permission denied" for ping and asked only the server's own resolver. Ping now falls back to a raw ICMP socket (the server unit gets CAP_NET_RAW, like /bin/ping); DNS asks the DNS agents outside clusters when no name server addresses are configured, gives every server its own timeout, and explains missing records (dynamic zone, system resolver, not deployed yet). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
1.3 KiB
Plaintext
50 lines
1.3 KiB
Plaintext
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Template of the management server unit (ADR 0018, 0024). Placeholders
|
|
# (at-sign NAME at-sign) are replaced by scripts/render-units.sh.
|
|
[Unit]
|
|
Description=@DISPLAY_NAME@ management server
|
|
Documentation=https://git.beugsiud.de/beug.k/DDI
|
|
Wants=network-online.target
|
|
After=network-online.target postgresql.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=@PRODUCT@
|
|
Group=@PRODUCT@
|
|
Environment=@ENV_PREFIX@CONFIG_FILE=@CONFIG_DIR@/server.yaml
|
|
ExecStart=@BINDIR@/@BIN_SERVER@ serve
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
StateDirectory=@PRODUCT@/server
|
|
StateDirectoryMode=0750
|
|
UMask=0027
|
|
|
|
# Hardening (ADR 0024).
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
# Only for the address check (ping): raw ICMP sockets where unprivileged
|
|
# ICMP sockets are not permitted (ADR 0025), like /bin/ping.
|
|
CapabilityBoundingSet=CAP_NET_RAW
|
|
AmbientCapabilities=CAP_NET_RAW
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|