48 lines
1.9 KiB
Plaintext
48 lines
1.9 KiB
Plaintext
# Template: copy to /etc/systemd/system/maestro-egress.service and replace
|
|
# /opt/maestro and /etc/maestro/maestro.env for the local installation.
|
|
#
|
|
# Address roles on Linux loopback:
|
|
# 127.0.0.2 dedicated Squid listener (outbound)
|
|
# 127.0.0.3 dedicated source address of an ingress reverse proxy
|
|
# 127.0.0.4 MAESTRO listener
|
|
#
|
|
# The ingress proxy must bind its MAESTRO-facing connection to 127.0.0.3.
|
|
# A direct client sourced from 127.0.0.1 is intentionally rejected. Never solve
|
|
# that by allowing 127.0.0.0/8: every IPAddressAllow also permits outbound use.
|
|
|
|
[Unit]
|
|
Description=MAESTRO staging egress-boundary template
|
|
After=network-online.target squid.service
|
|
Wants=network-online.target
|
|
Requires=squid.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=maestro
|
|
Group=maestro
|
|
WorkingDirectory=/opt/maestro
|
|
EnvironmentFile=-/etc/maestro/maestro.env
|
|
ExecStartPre=/usr/bin/env -u NODE_OPTIONS /usr/bin/node /opt/maestro/dist/scripts/migrate-db.js
|
|
ExecStart=/usr/bin/env -u NODE_OPTIONS -u http_proxy -u https_proxy -u no_proxy -u ALL_PROXY -u all_proxy NODE_ENV=production AAO_MODE=worker HOST=127.0.0.4 HTTP_PROXY=http://127.0.0.2:3128 HTTPS_PROXY=http://127.0.0.2:3128 NO_PROXY= /usr/bin/node --use-env-proxy /opt/maestro/dist/main.js
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
UMask=0077
|
|
NoNewPrivileges=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
|
|
# Intended cgroup-BPF policy. This is a staging-only design example until a
|
|
# target host proves enforcement with independent canaries. The first address
|
|
# is the proxy endpoint; the second is the ingress source. Reserve both.
|
|
IPAddressDeny=any
|
|
IPAddressAllow=127.0.0.2/32
|
|
IPAddressAllow=127.0.0.3/32
|
|
IPAccounting=yes
|
|
|
|
# IPv6 remains fully denied. If a dedicated proxy/ingress pair is provisioned,
|
|
# add their individual /128 values. Do not allow ::1/128 as a convenience.
|
|
# IPAddressAllow=fd00:4d41:4553:5452::2/128
|
|
# IPAddressAllow=fd00:4d41:4553:5452::3/128
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|