[Unit]
Description=Fleet workstation host-info API (loopback, read-only)
Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/HOST-API.md
# Needs networking up only to read the primary IP/MAC; the listener is loopback.
After=network-online.target
Wants=network-online.target

[Service]
Type=exec
ExecStart=/usr/local/bin/fleet-hostapi
Environment=FLEET_HOSTAPI_ADDR=127.0.0.1:9099
# Lab default: any origin may read (it's a loopback, read-only facts service on a
# single-purpose kiosk). Tighten to the exact kiosk origin in production, e.g.
#   Environment=FLEET_HOSTAPI_ALLOW_ORIGIN=http://boot.fleet.lab
Environment=FLEET_HOSTAPI_ALLOW_ORIGIN=*
Environment=FLEET_HOSTAPI_FACTS=/etc/fleet-hostinfo.json
Restart=on-failure
RestartSec=2

# --- sandboxing (STIG-friendly; the agent only READS /proc, /sys, /etc) -------
# Runs as a transient unprivileged user with no capabilities; everything it
# reads is world-readable, so it needs no privilege at all.
DynamicUser=yes
CapabilityBoundingSet=
AmbientCapabilities=
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
ProtectProc=default
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
RestrictAddressFamilies=AF_INET AF_INET6
# Kernel-enforced loopback-only egress/ingress (belt + suspenders to the bind).
IPAddressAllow=localhost
IPAddressDeny=any
UMask=0077

[Install]
WantedBy=multi-user.target