Add Host API and fix kiosk performance

2026-06-28 03:14:25 +00:00
parent b5163f958e
commit ad6b7e3366
12 changed files with 747 additions and 37 deletions
@@ -0,0 +1,52 @@
+[Unit]
+Description=Fleet workstation host-info API (loopback, read-only)
+Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/HOST-API.md
+# Needs networking up only to read the primary IP/MAC; the listener is loopback.
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=exec
+ExecStart=/usr/local/bin/fleet-hostapi
+Environment=FLEET_HOSTAPI_ADDR=127.0.0.1:9099
+# Lab default: any origin may read (it's a loopback, read-only facts service on a
+# single-purpose kiosk). Tighten to the exact kiosk origin in production, e.g.
+#   Environment=FLEET_HOSTAPI_ALLOW_ORIGIN=http://boot.fleet.lab
+Environment=FLEET_HOSTAPI_ALLOW_ORIGIN=*
+Environment=FLEET_HOSTAPI_FACTS=/etc/fleet-hostinfo.json
+Restart=on-failure
+RestartSec=2
+
+# --- sandboxing (STIG-friendly; the agent only READS /proc, /sys, /etc) -------
+# Runs as a transient unprivileged user with no capabilities; everything it
+# reads is world-readable, so it needs no privilege at all.
+DynamicUser=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=default
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+RestrictAddressFamilies=AF_INET AF_INET6
+# Kernel-enforced loopback-only egress/ingress (belt + suspenders to the bind).
+IPAddressAllow=localhost
+IPAddressDeny=any
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target