🚧 WIP

2026-10-07 07:40:56 +02:00
parent c8b655111e
commit 9f3272094e
17 changed files with 2243 additions and 89 deletions
@@ -0,0 +1,52 @@
+# systemd unit for the host-side hostnet agent (spec §15, FR-15.2.7).
+#
+# This runs ON THE DOCKER HOST — not in the container. It is the only
+# component that holds the privileges to change host interface
+# addresses (root or CAP_NET_ADMIN), scoped by the whitelist in its
+# config file.
+#
+# Install:
+#   sudo cp wago-sim-hostnet-agent.service /etc/systemd/system/
+#   sudo cp hostnet-agent.yaml /etc/wago-sim/hostnet.yaml
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now wago-sim-hostnet-agent
+#
+# Logs: journalctl -u wago-sim-hostnet-agent -f
+#        (the agent's audit lines appear here AND on the web page)
+#
+# The simulator container connects through /run/wago-sim/hostnet.sock —
+# docker-compose.yml mounts /run/wago-sim into the container. The
+# socket is created 0660 (root:wago-sim by the directives below); put
+# the container's non-root user in the same group (compose passes the
+# host group via group_add).
+
+[Unit]
+Description=WAGO simulator hostnet agent (host IP settings page)
+Documentation=file:///opt/wago-sim/docs/spec/software-spec.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# root keeps netlink + `ip` simple; hardening still applies below.
+# Alternative: a dedicated user + AmbientCapabilities=CAP_NET_ADMIN.
+User=root
+Environment=WAGO_SIM_HOSTNET_AGENT_CONFIG=/etc/wago-sim/hostnet.yaml
+ExecStart=/opt/wago-sim/.venv/bin/wago-sim hostnet-agent \
+    --config /etc/wago-sim/hostnet.yaml
+Restart=on-failure
+RestartSec=2
+
+# Hardening: the agent needs network-admin on whitelisted interfaces
+# and nothing else. The filesystem is locked down except for its
+# config (read), socket directory and audit file (write). CAP_NET_RAW
+# is included because netlink socket ops request it.
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadWritePaths=/run/wago-sim /var/log/wago-sim
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+
+[Install]
+WantedBy=multi-user.target