feat: initial commit

deploy/lpra-server.service

@@ -0,0 +1,58 @@
+# systemd unit for the LPRA host (server).
+#
+# Unlike the agent, the server does NOT need root: it listens on a high local
+# port (127.0.0.1:8091) behind nginx, so run it as an unprivileged user.
+#
+# Install:
+#   sudo useradd --system --home /opt/lpra --shell /usr/sbin/nologin lpra
+#   sudo mkdir -p /opt/lpra /var/lib/lpra
+#   sudo cp bin/lpra-server /opt/lpra/
+#   sudo cp -r dist /opt/lpra/dist           # agent binaries served at /download/
+#   sudo chown -R lpra:lpra /opt/lpra /var/lib/lpra
+#   sudo cp deploy/lpra-server.service /etc/systemd/system/
+#   sudo systemctl daemon-reload && sudo systemctl enable --now lpra-server
+#
+# Config overrides can go in /etc/lpra-server.env (see EnvironmentFile below),
+# e.g.  LPRA_ADDR=127.0.0.1:8091
+#
+# Direct port forwarding (tcp/udp modes) uses port 8446 on the host — open it in
+# the firewall:  ufw allow 8446/tcp ; ufw allow 8446/udp
+# (The "http" forward mode and terminal/files go through nginx :8445 and need
+# nothing extra.) Override with LPRA_TUNNEL_ADDR, or set it empty to disable.
+
+[Unit]
+Description=LPRA remote access host (admin panel + agent rendezvous)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=lpra
+Group=lpra
+WorkingDirectory=/opt/lpra
+
+# Optional environment overrides; "-" means the file is not required.
+EnvironmentFile=-/etc/lpra-server.env
+
+ExecStart=/opt/lpra/lpra-server \
+    -addr 127.0.0.1:8091 \
+    -db /var/lib/lpra/lpra.db \
+    -dist /opt/lpra/dist
+
+Restart=always
+RestartSec=3
+
+# --- hardening ---
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+# The server only needs to write its SQLite database here.
+ReadWritePaths=/var/lib/lpra
+
+[Install]
+WantedBy=multi-user.target

deploy/nginx.conf.example

@@ -0,0 +1,42 @@
+# nginx reverse proxy for the LPRA server.
+# TLS is terminated here; the Go server listens on 127.0.0.1:8091.
+#
+# Put this in /etc/nginx/sites-available/lp_agent and symlink it into
+# sites-enabled, then:  sudo nginx -t && sudo systemctl reload nginx
+#
+# Everything (agent + browser terminal) is plain HTTP long-polling, so NO
+# WebSocket config is needed. The two settings that matter:
+#   - proxy_buffering off      -> deliver long-poll responses immediately
+#   - proxy_read_timeout 120s  -> longer than the 25s long-poll hold
+#
+# NOTE: proxy_pass MUST start with "http://". A bare "proxy_pass 127.0.0.1:8091;"
+# causes nginx error:  [emerg] invalid URL prefix.
+
+server {
+    listen 8445 ssl;
+    server_name REDACTED;
+
+    ssl_certificate /etc/letsencrypt/live/REDACTED/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/REDACTED/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+    # Agent binaries can be large; allow the download.
+    client_max_body_size 64m;
+
+    location / {
+        proxy_pass http://127.0.0.1:8091;
+
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Long-poll behaviour: no buffering, generous read timeout.
+        proxy_buffering     off;
+        proxy_cache         off;
+        proxy_read_timeout  120s;
+        proxy_send_timeout  120s;
+    }
+}