mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-19 19:01:42 +00:00
Josh Siviour
e30ec82f6a
* feat: gate the Ochre console behind a runtime flag Add OchreEnabled to the spinifexui service config and /api/config body, defaulting to false so the console and every /bedrock/* route stay hidden until a node explicitly turns it on. * feat: wire the Ochre flag through to the spinifex-ui service unit Add a spinifex-ui-ochre-enabled flag (SPINIFEX_UI_OCHRE_ENABLED, off by default) so the console flag can actually be set on a deployed node, and bump the service unit so the reconciler picks it up.
62 lines
1.6 KiB
Desktop File
62 lines
1.6 KiB
Desktop File
# spinifex-unit-version: 2
|
|
[Unit]
|
|
Description=Spinifex Web UI
|
|
PartOf=spinifex.target
|
|
After=spinifex-awsgw.service
|
|
|
|
[Service]
|
|
EnvironmentFile=-/etc/spinifex/telemetry.env
|
|
Type=simple
|
|
Slice=spinifex-system.slice
|
|
User=spinifex-ui
|
|
Group=spinifex
|
|
ExecStart=/usr/local/bin/spx service spinifex-ui start
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
# server.Shutdown() uses an internal 30s context (WriteTimeout=120s covers
|
|
# long streaming proxy responses, e.g. console passthrough); add margin above it.
|
|
TimeoutStopSec=40
|
|
OOMScoreAdjust=-500
|
|
# Per-service ceiling bounds a leak in this service alone rather than
|
|
# tripping the slice-wide cap, which would pick an arbitrary victim.
|
|
MemoryHigh=10%
|
|
MemoryMax=20%
|
|
Environment=SPINIFEX_UI_TLS_CERT=/etc/spinifex/server.pem
|
|
Environment=SPINIFEX_UI_TLS_KEY=/etc/spinifex/server.key
|
|
Environment=SPINIFEX_UI_BASE_DIR=/var/lib/spinifex/spinifex-ui/
|
|
Environment=SPINIFEX_UI_OCHRE_ENABLED=false
|
|
|
|
# Filesystem access
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
PrivateDevices=yes
|
|
ReadOnlyPaths=/etc/spinifex/server.pem /etc/spinifex/server.key
|
|
ReadWritePaths=/var/lib/spinifex/spinifex-ui /var/log/spinifex
|
|
|
|
# Hardening
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
ProtectClock=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectProc=invisible
|
|
SystemCallArchitectures=native
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
CapabilityBoundingSet=
|
|
ProtectHostname=yes
|
|
KeyringMode=private
|
|
RemoveIPC=yes
|
|
LimitCORE=0
|
|
LimitNOFILE=65536
|
|
LimitNPROC=4096
|
|
|
|
[Install]
|
|
WantedBy=spinifex.target
|