sync: update from private repo (2336949a)

2026-09-17 11:29:31 +00:00
parent 28f74c4e37
commit 57702b4f34
2139 changed files with 321270 additions and 17494 deletions
@@ -0,0 +1,37 @@
+# MAESTRO explicit forward-proxy policy template.
+#
+# This file deliberately starts with one RFC 6761 .invalid canary. Replace the
+# host with an operator-approved exact hostname before enabling production
+# traffic. Do not add a leading dot: `.example.com` also permits subdomains.
+# Give each hostname+port pair its own two ACLs and one http_access line.
+
+# Dedicated address reserved for this proxy. Do not bind another service here:
+# systemd IPAddressAllow is address-based and cannot restrict the port.
+http_port 127.0.0.2:3128
+
+# Example exact pair: allowed.egress.invalid:443. This domain cannot resolve on
+# the public DNS and therefore fails closed until the operator replaces it.
+acl maestro_llm_host dstdomain -n allowed.egress.invalid
+acl maestro_llm_port port 443
+
+acl CONNECT method CONNECT
+acl supported_methods method GET HEAD POST PUT PATCH DELETE OPTIONS CONNECT
+
+# Reject unlisted methods, then allow only an exact hostname+port pair.
+http_access deny !supported_methods
+http_access allow maestro_llm_host maestro_llm_port
+http_access deny all
+
+# Forward only. Do not retain content or per-request access records.
+cache deny all
+cache_store_log none
+access_log none
+
+# Keep operational diagnostics from becoming a second request log.
+debug_options ALL,0
+
+# Optional short-lived metadata observation profile. It omits URL/path/query,
+# request and response headers, bodies, and DNS names. Enabling it still records
+# destination IP and timing, so review retention and file permissions first.
+# logformat maestro_meta %ts.%03tu %rm %<A:%<p %Ss/%03>Hs %<st %tr
+# access_log daemon:/var/log/squid/maestro-egress-metadata.log maestro_meta
@@ -0,0 +1,47 @@
+# Template: copy to /etc/systemd/system/maestro-egress.service and replace
+# /opt/maestro and /etc/maestro/maestro.env for the local installation.
+#
+# Address roles on Linux loopback:
+#   127.0.0.2  dedicated Squid listener (outbound)
+#   127.0.0.3  dedicated source address of an ingress reverse proxy
+#   127.0.0.4  MAESTRO listener
+#
+# The ingress proxy must bind its MAESTRO-facing connection to 127.0.0.3.
+# A direct client sourced from 127.0.0.1 is intentionally rejected. Never solve
+# that by allowing 127.0.0.0/8: every IPAddressAllow also permits outbound use.
+
+[Unit]
+Description=MAESTRO staging egress-boundary template
+After=network-online.target squid.service
+Wants=network-online.target
+Requires=squid.service
+
+[Service]
+Type=simple
+User=maestro
+Group=maestro
+WorkingDirectory=/opt/maestro
+EnvironmentFile=-/etc/maestro/maestro.env
+ExecStartPre=/usr/bin/env -u NODE_OPTIONS /usr/bin/node /opt/maestro/dist/scripts/migrate-db.js
+ExecStart=/usr/bin/env -u NODE_OPTIONS -u http_proxy -u https_proxy -u no_proxy -u ALL_PROXY -u all_proxy NODE_ENV=production AAO_MODE=worker HOST=127.0.0.4 HTTP_PROXY=http://127.0.0.2:3128 HTTPS_PROXY=http://127.0.0.2:3128 NO_PROXY= /usr/bin/node --use-env-proxy /opt/maestro/dist/main.js
+Restart=on-failure
+RestartSec=5s
+UMask=0077
+NoNewPrivileges=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+# Intended cgroup-BPF policy. This is a staging-only design example until a
+# target host proves enforcement with independent canaries. The first address
+# is the proxy endpoint; the second is the ingress source. Reserve both.
+IPAddressDeny=any
+IPAddressAllow=127.0.0.2/32
+IPAddressAllow=127.0.0.3/32
+IPAccounting=yes
+
+# IPv6 remains fully denied. If a dedicated proxy/ingress pair is provisioned,
+# add their individual /128 values. Do not allow ::1/128 as a convenience.
+# IPAddressAllow=fd00:4d41:4553:5452::2/128
+# IPAddressAllow=fd00:4d41:4553:5452::3/128
+
+[Install]
+WantedBy=multi-user.target