52 lines
1.9 KiB
Desktop File
52 lines
1.9 KiB
Desktop File
# systemd unit for the host-side hostnet agent (spec §15, FR-15.2.7).
|
|
#
|
|
# This runs ON THE DOCKER HOST — not in the container. It is the only
|
|
# component that holds the privileges to change host interface
|
|
# addresses (root or CAP_NET_ADMIN), scoped by the whitelist in its
|
|
# config file.
|
|
#
|
|
# Install:
|
|
# sudo cp wago-sim-hostnet-agent.service /etc/systemd/system/
|
|
# sudo cp hostnet-agent.yaml /etc/wago-sim/hostnet.yaml
|
|
# sudo systemctl daemon-reload
|
|
# sudo systemctl enable --now wago-sim-hostnet-agent
|
|
#
|
|
# Logs: journalctl -u wago-sim-hostnet-agent -f
|
|
# (the agent's audit lines appear here AND on the web page)
|
|
#
|
|
# The simulator container connects through /run/wago-sim/hostnet.sock —
|
|
# docker-compose.yml mounts /run/wago-sim into the container. The
|
|
# socket is created 0660 (root:wago-sim by the directives below); put
|
|
# the container's non-root user in the same group (compose passes the
|
|
# host group via group_add).
|
|
|
|
[Unit]
|
|
Description=WAGO simulator hostnet agent (host IP settings page)
|
|
Documentation=file:///opt/wago-sim/docs/spec/software-spec.md
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
# root keeps netlink + `ip` simple; hardening still applies below.
|
|
# Alternative: a dedicated user + AmbientCapabilities=CAP_NET_ADMIN.
|
|
User=root
|
|
Environment=WAGO_SIM_HOSTNET_AGENT_CONFIG=/etc/wago-sim/hostnet.yaml
|
|
ExecStart=/opt/wago-sim/.venv/bin/wago-sim hostnet-agent \
|
|
--config /etc/wago-sim/hostnet.yaml
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
|
|
# Hardening: the agent needs network-admin on whitelisted interfaces
|
|
# and nothing else. The filesystem is locked down except for its
|
|
# config (read), socket directory and audit file (write). CAP_NET_RAW
|
|
# is included because netlink socket ops request it.
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ReadWritePaths=/run/wago-sim /var/log/wago-sim
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target |