redtea
5e6e0b8a3a
The panel's ufw integration needs root; the database now lives next to the binary in /opt/lpra.
63 lines
2.1 KiB
Desktop File
63 lines
2.1 KiB
Desktop File
# systemd unit for the LPRA host (server).
|
|
#
|
|
# Unlike the agent, the server does NOT need root: it listens on a high local
|
|
# port (127.0.0.1:8091) behind nginx, so run it as an unprivileged user.
|
|
#
|
|
# Install:
|
|
# sudo useradd --system --home /opt/lpra --shell /usr/sbin/nologin lpra
|
|
# sudo mkdir -p /opt/lpra /var/lib/lpra
|
|
# sudo cp bin/lpra-server /opt/lpra/
|
|
# sudo cp -r dist /opt/lpra/dist # agent binaries served at /download/
|
|
# sudo chown -R lpra:lpra /opt/lpra /var/lib/lpra
|
|
# sudo cp deploy/lpra-server.service /etc/systemd/system/
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now lpra-server
|
|
#
|
|
# Config overrides can go in /etc/lpra-server.env (see EnvironmentFile below),
|
|
# e.g. LPRA_ADDR=127.0.0.1:8091
|
|
#
|
|
# Direct port forwarding (tcp/udp modes) uses port 8446 on the host — open it in
|
|
# the firewall: ufw allow 8446/tcp ; ufw allow 8446/udp
|
|
# (The "http" forward mode and terminal/files go through nginx :8445 and need
|
|
# nothing extra.) Override with LPRA_TUNNEL_ADDR, or set it empty to disable.
|
|
# The port, and the host agents dial for it, can also be changed in the panel
|
|
# settings; agents pick the new address up from the panel by themselves.
|
|
#
|
|
# ufw integration (the panel opening forwarded ports itself) needs the server
|
|
# to run as root, and ufw's state must be writable despite ProtectSystem=strict
|
|
# below — otherwise "ufw status" works but "ufw allow" fails:
|
|
# ReadWritePaths=/etc/ufw /run
|
|
|
|
[Unit]
|
|
Description=LPRA remote access host (admin panel + agent rendezvous)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
WorkingDirectory=/opt/lpra
|
|
|
|
# Optional environment overrides; "-" means the file is not required.
|
|
|
|
|
|
ExecStart=/opt/lpra/lpra-server \
|
|
-addr 127.0.0.1:8091 \
|
|
-db /opt/lpra/lpra.db \
|
|
-dist /opt/lpra/dist
|
|
|
|
Restart=always
|
|
RestartSec=3
|
|
|
|
# --- hardening ---
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectKernelTunables=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
# The server only needs to write its SQLite database here.
|
|
ReadWritePaths=/opt/lpra
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|