redtea
bcfe909aaa
The direct tunnel port (8446 by default) and the host agents dial for it can be set in Settings. The server moves its listeners at once and agents pick the address up from the panel: on connect and with every poll, unless TUNNEL_ADDR / TUNNEL_PORT pin it locally. ufw: run with a C locale (the output is translated), do not adopt rules that existed before the panel, skip loopback-only listeners, re-open what saved forwards need on start and when the integration is turned on, move the shared tunnel rule with the port and drop it when no direct forward is left. The last ufw error is shown in Settings. The forwards page shows the real tunnel and panel ports.
66 lines
2.2 KiB
Desktop File
66 lines
2.2 KiB
Desktop File
# systemd unit for the LPRA host (server).
|
|
#
|
|
# Unlike the agent, the server does NOT need root: it listens on a high local
|
|
# port (127.0.0.1:8091) behind nginx, so run it as an unprivileged user.
|
|
#
|
|
# Install:
|
|
# sudo useradd --system --home /opt/lpra --shell /usr/sbin/nologin lpra
|
|
# sudo mkdir -p /opt/lpra /var/lib/lpra
|
|
# sudo cp bin/lpra-server /opt/lpra/
|
|
# sudo cp -r dist /opt/lpra/dist # agent binaries served at /download/
|
|
# sudo chown -R lpra:lpra /opt/lpra /var/lib/lpra
|
|
# sudo cp deploy/lpra-server.service /etc/systemd/system/
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now lpra-server
|
|
#
|
|
# Config overrides can go in /etc/lpra-server.env (see EnvironmentFile below),
|
|
# e.g. LPRA_ADDR=127.0.0.1:8091
|
|
#
|
|
# Direct port forwarding (tcp/udp modes) uses port 8446 on the host — open it in
|
|
# the firewall: ufw allow 8446/tcp ; ufw allow 8446/udp
|
|
# (The "http" forward mode and terminal/files go through nginx :8445 and need
|
|
# nothing extra.) Override with LPRA_TUNNEL_ADDR, or set it empty to disable.
|
|
# The port, and the host agents dial for it, can also be changed in the panel
|
|
# settings; agents pick the new address up from the panel by themselves.
|
|
#
|
|
# ufw integration (the panel opening forwarded ports itself) needs the server
|
|
# to run as root, and ufw's state must be writable despite ProtectSystem=strict
|
|
# below — otherwise "ufw status" works but "ufw allow" fails:
|
|
# ReadWritePaths=/etc/ufw /run
|
|
|
|
[Unit]
|
|
Description=LPRA remote access host (admin panel + agent rendezvous)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=lpra
|
|
Group=lpra
|
|
WorkingDirectory=/opt/lpra
|
|
|
|
# Optional environment overrides; "-" means the file is not required.
|
|
EnvironmentFile=-/etc/lpra-server.env
|
|
|
|
ExecStart=/opt/lpra/lpra-server \
|
|
-addr 127.0.0.1:8091 \
|
|
-db /var/lib/lpra/lpra.db \
|
|
-dist /opt/lpra/dist
|
|
|
|
Restart=always
|
|
RestartSec=3
|
|
|
|
# --- hardening ---
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectKernelTunables=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
# The server only needs to write its SQLite database here.
|
|
ReadWritePaths=/var/lib/lpra
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|