mteehan
9c9f92ad04
systemd: pre-create volatile /run paths so vacuum-walld's ProtectSystem=strict namespace setup cannot fail with 226/NAMESPACE — RuntimeDirectory=vacuum-wall nginx plus a tmpfiles.d spec (installed to /etc/tmpfiles.d/) covering /run/firewalld and /run/nginx.pid. Drop /run/sudo from ReadWritePaths: NOPASSWD children never need it, and its absence crash-looped restarts after sudo removed /run/sudo.
webui: run the auth session check before mounting the shell so logged-out visitors never flash the sidebar or a protected page; router guard and sidebar now react to auth state, and the login page renders full-bleed.
ws: cap refresh->reconnect episodes at 2 consecutive failures; if the WS path stays dead after a token refresh, abandon reconnection instead of looping refreshAuth forever (UI keeps working via REST until reload).
api: GET /api/network/interfaces now includes loopback and returns per-interface {config, runtime}; dashboard reads runtime.state (carrier counts as up) and the interfaces page filters lo client-side.
daemon: re-collect nginx state after lazy config migration (cached list went stale when the on-disk format changed under it), skip system_import.nginx when config.json already exists (re-parsing vacuum-wall's own generated sites is lossy), and poll nginx (60s) / acme (300s) state so file drift self-heals.
74 lines
2.9 KiB
Desktop File
74 lines
2.9 KiB
Desktop File
[Unit]
|
|
Description=Vacuum Wall Daemon (privileged backend)
|
|
Documentation=https://github.com/wall/vacuum-wall
|
|
After=network.target firewalld.service
|
|
Wants=firewalld.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User={{ USER_DAEMON_NAME }}
|
|
Group={{ USER_GROUP }}
|
|
WorkingDirectory={{ PROJECT_DIR }}
|
|
ExecStart={{ PROJECT_DIR }}/.venv/bin/python -m daemon
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
TimeoutStopSec=15
|
|
Environment=PATH=/usr/local/bin:/usr/bin
|
|
Environment=PYTHONUNBUFFERED=1
|
|
Environment=ACME_HOME={{ PROJECT_DIR }}/data/acme
|
|
Environment=HOME={{ PROJECT_DIR }}
|
|
|
|
# Runtime directories created before namespace setup. ProtectSystem=strict
|
|
# makes the whole hierarchy read-only, and namespace setup fails
|
|
# (exit 226/NAMESPACE) if any ReadWritePaths= entry is missing at spawn.
|
|
# /run is a fresh tmpfs at every boot, so volatile /run paths must be
|
|
# created up front (RuntimeDirectory= here; /run/firewalld via
|
|
# system/tmpfiles.d/vacuum-wall.conf and by firewalld itself) rather than
|
|
# at first use.
|
|
# vacuum-wall : secure temp files used during config apply
|
|
# nginx : /run/nginx (listed in ReadWritePaths)
|
|
RuntimeDirectory=vacuum-wall nginx
|
|
RuntimeDirectoryMode=0750
|
|
|
|
LogsDirectory=vacuum-wall
|
|
|
|
# Security hardening
|
|
ProtectSystem=strict
|
|
# NOTE: every ReadWritePaths= entry must exist when the unit spawns or namespace
|
|
# setup fails (226/NAMESPACE). Volatile /run entries are pre-created:
|
|
# /run/vacuum-wall, /run/nginx → RuntimeDirectory= (above)
|
|
# /run/firewalld → system/tmpfiles.d/vacuum-wall.conf (and is
|
|
# present while firewalld runs, which starts
|
|
# before this unit)
|
|
# /run/sudo is intentionally NOT listed: the daemon's sudo children use the
|
|
# NOPASSWD whitelist and never need sudo's session directory (verified with
|
|
# the directory absent). Listing it made the unit crash-loop whenever it
|
|
# restarted after the last sudo session had ended and sudo removed /run/sudo.
|
|
# /run/nginx.pid IS listed: nginx -t opens the pid file for *writing* in
|
|
# addition to -s/acme reading it, so a read-only mount makes every daemon-side
|
|
# `nginx -t` (and therefore /nginx/apply) fail with EROFS. The file is
|
|
# pre-created by system/tmpfiles.d/vacuum-wall.conf so the ReadWritePaths=
|
|
# entry always exists at spawn (nginx rewrites it on start; nginx -t does
|
|
# not modify its contents).
|
|
ReadWritePaths={{ PROJECT_DIR }} /tmp /etc/systemd/network /etc/nginx /etc/dnsmasq.d /etc/wireguard /run/vacuum-wall /run/firewalld /run/nginx /run/nginx.pid /var/log/nginx /var/log/vacuum-wall
|
|
PrivateTmp=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHostname=yes
|
|
RestrictSUIDSGID=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
LockPersonality=yes
|
|
SystemCallFilter=@system-service
|
|
PrivateDevices=yes
|
|
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
IPAddressDeny=any
|
|
IPAddressAllow=localhost
|
|
NoNewPrivileges=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|