jcoffey-dev
e11fdae372
Dockerfile.relay builds inbuxa-relay alone, as a static musl binary, into a FROM-scratch image of about 12 MB: the binary, the CA roots and a state directory, run as uid 2001 with cap_net_bind_service only, and INBUXA_RELAY_CONTAINER set so the relay doesn't upgrade itself. A release tag builds it on whichever forge builds, under the server's tags, after checking that the image prints this version and holds no server binary (RL-T24). The release gets the two binaries, taken out of the image, in SHA256SUMS with the server's. Gitea's relay-sign job then signs them with the RELAY_RELEASE_KEY secret and attaches the .sig files; without the secret it warns and signs nothing. tools/release/new-relay-keys.sh makes the CI key and an offline backup key and prints only their public halves. resources/systemd has the unit for a host install: binary in /opt/inbuxa-relay/bin, owned by the relay's user so upgrades can replace it, Restart=always, sandboxed.
45 lines
1.2 KiB
Desktop File
45 lines
1.2 KiB
Desktop File
# inbuxa Relay on a host (relay spec, RL-31). The binary lives in
|
|
# /opt/inbuxa-relay/bin, owned by the inbuxa-relay user, so an upgrade from
|
|
# inbuxa-admin can replace it (RL-29); the relay then exits, and Restart=
|
|
# starts the new one. It may bind ports 25 and 443 and nothing more.
|
|
[Unit]
|
|
Description=inbuxa Relay
|
|
Conflicts=postfix.service sendmail.service exim4.service
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/opt/inbuxa-relay/bin/inbuxa-relay run --state /var/lib/inbuxa-relay
|
|
Restart=always
|
|
RestartSec=2
|
|
SyslogIdentifier=inbuxa-relay
|
|
User=inbuxa-relay
|
|
Group=inbuxa-relay
|
|
StateDirectory=inbuxa-relay
|
|
StateDirectoryMode=0700
|
|
LimitNOFILE=65536
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/opt/inbuxa-relay/bin
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|