feat: initial commit

deploy/lpra-server.service

@@ -0,0 +1,58 @@
+# systemd unit for the LPRA host (server).
+#
+# Unlike the agent, the server does NOT need root: it listens on a high local
+# port (127.0.0.1:8091) behind nginx, so run it as an unprivileged user.
+#
+# Install:
+#   sudo useradd --system --home /opt/lpra --shell /usr/sbin/nologin lpra
+#   sudo mkdir -p /opt/lpra /var/lib/lpra
+#   sudo cp bin/lpra-server /opt/lpra/
+#   sudo cp -r dist /opt/lpra/dist           # agent binaries served at /download/
+#   sudo chown -R lpra:lpra /opt/lpra /var/lib/lpra
+#   sudo cp deploy/lpra-server.service /etc/systemd/system/
+#   sudo systemctl daemon-reload && sudo systemctl enable --now lpra-server
+#
+# Config overrides can go in /etc/lpra-server.env (see EnvironmentFile below),
+# e.g.  LPRA_ADDR=127.0.0.1:8091
+#
+# Direct port forwarding (tcp/udp modes) uses port 8446 on the host — open it in
+# the firewall:  ufw allow 8446/tcp ; ufw allow 8446/udp
+# (The "http" forward mode and terminal/files go through nginx :8445 and need
+# nothing extra.) Override with LPRA_TUNNEL_ADDR, or set it empty to disable.
+
+[Unit]
+Description=LPRA remote access host (admin panel + agent rendezvous)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=lpra
+Group=lpra
+WorkingDirectory=/opt/lpra
+
+# Optional environment overrides; "-" means the file is not required.
+EnvironmentFile=-/etc/lpra-server.env
+
+ExecStart=/opt/lpra/lpra-server \
+    -addr 127.0.0.1:8091 \
+    -db /var/lib/lpra/lpra.db \
+    -dist /opt/lpra/dist
+
+Restart=always
+RestartSec=3
+
+# --- hardening ---
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+# The server only needs to write its SQLite database here.
+ReadWritePaths=/var/lib/lpra
+
+[Install]
+WantedBy=multi-user.target