sir_melonchenandClaude Opus 5.5
2555028956
ci / Protobuf (push) Successful in 12s
ci / Web (lint, test, audit, build) (push) Successful in 2m44s
ci / Shell and licence headers (push) Successful in 21s
ci / Go (lint, test, vuln) (push) Successful in 6m22s
ci / Release build (dry run) (push) Successful in 3m51s
ci / Integration (real BIND and Kea) (push) Successful in 2m33s
ci / Development environment (compose) (push) Successful in 17s
ci / End-to-end (server, agents, BIND, Kea) (push) Successful in 4m14s
install / Installation (debian:12) (push) Successful in 4m54s
install / Installation (debian:13) (push) Successful in 5m6s
install / Installation (ubuntu:22.04) (push) Successful in 5m16s
install / Installation (rocky:9) (push) Successful in 7m28s
install / Installation (ubuntu:24.04) (push) Successful in 8m58s
release / release (push) Successful in 4m11s
An agent installed without token and enrolled with the command of the web interface never ran as a service: the installer left the unit disabled and the root-run enrollment left an identity the service user could not read. The installer now always enables the agent unit (it waits for the identity via ConditionPathExists), enroll as root hands the state over to the service user and enables and starts the unit, and rerunning or upgrading the installer repairs agents enrolled by hand. The web interface shows the matching installer command next to the enroll command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
51 lines
1.5 KiB
Plaintext
51 lines
1.5 KiB
Plaintext
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Template of the dns agent unit (ADR 0018, 0024). Placeholders (at-sign NAME at-sign)
|
|
# are replaced by scripts/render-units.sh. The
|
|
# installer sets User= and Group= to the BIND (named) user in a drop-in
|
|
# (10-user.conf): the agent runs with the rights of the service it manages.
|
|
[Unit]
|
|
Description=@DISPLAY_NAME@ dns agent (BIND (named))
|
|
Documentation=https://git.beugsiud.de/beug.k/DDI
|
|
Wants=network-online.target
|
|
After=network-online.target named.service bind9.service
|
|
# Enabled by the installer right away; starts once the agent is enrolled
|
|
# (`enroll` as root starts it directly).
|
|
ConditionPathExists=/var/lib/@PRODUCT@/agent-dns/identity/agent.json
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=@BINDIR@/@BIN_AGENT_DNS@ run
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
StateDirectory=@PRODUCT@/agent-dns
|
|
StateDirectoryMode=0700
|
|
UMask=0027
|
|
ReadWritePaths=-/etc/bind/@PRODUCT@ -/etc/named/@PRODUCT@ -/var/lib/bind/@PRODUCT@
|
|
|
|
# Hardening (ADR 0024).
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|