53 lines
1.7 KiB
Desktop File
53 lines
1.7 KiB
Desktop File
[Unit]
|
|
Description=Fleet workstation host-info API (loopback, read-only)
|
|
Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/HOST-API.md
|
|
# Needs networking up only to read the primary IP/MAC; the listener is loopback.
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
ExecStart=/usr/local/bin/fleet-hostapi
|
|
Environment=FLEET_HOSTAPI_ADDR=127.0.0.1:9099
|
|
# Lab default: any origin may read (it's a loopback, read-only facts service on a
|
|
# single-purpose kiosk). Tighten to the exact kiosk origin in production, e.g.
|
|
# Environment=FLEET_HOSTAPI_ALLOW_ORIGIN=http://boot.fleet.lab
|
|
Environment=FLEET_HOSTAPI_ALLOW_ORIGIN=*
|
|
Environment=FLEET_HOSTAPI_FACTS=/etc/fleet-hostinfo.json
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
|
|
# --- sandboxing (STIG-friendly; the agent only READS /proc, /sys, /etc) -------
|
|
# Runs as a transient unprivileged user with no capabilities; everything it
|
|
# reads is world-readable, so it needs no privilege at all.
|
|
DynamicUser=yes
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectProc=default
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
# Kernel-enforced loopback-only egress/ingress (belt + suspenders to the bind).
|
|
IPAddressAllow=localhost
|
|
IPAddressDeny=any
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|