aa1912b962
RELAY-PHASE1 Wave A2/B/C/D/E (12-agent workflow, all tsc-clean, 314/314 tests pass): - A2: control-plane server.ts entry + boot/redis.ts revocation-bus wiring + start script. - B1: relay-run shared-store EnforceDeps (relay-auth ports over the SAME Postgres+Redis as P3). - B2: registry-backed MtlsVerifier (verifyAgentCert, fail-closed, INV14). - B3: store-backed RouteResolver (subdomain->hostId). - B4: Redis relay:revocations subscriber -> tunnel teardown (INV12). - B5: main-phase1.ts production entry (public bind, real TLS, async-mTLS prefetch bridge) + staging /auth/mint. - B6 (PARTIAL): relay-web operator login + browser DPoP; proof offered via term.dpop.<b64u> subprotocol. - C: agent dist/cli.js build (esbuild) + runTunnel run-loop + CliDeps. - D1: same-origin static serve of relay-web/public from the browser WSS. - E: systemd units + gen-ca/gen-capability-key/issue-tls-cert scripts + deploy/RUNBOOK.md. Adversarial review: all hard invariants PASS. Follow-ups (B7): close DPoP-subprotocol read on browser-server (blocks browser connect); rate-limit /auth/mint (F1); wire activeSessionCount (F2); scrub error logs (F5). Excludes unrelated public/style.css (concurrent iOS job).
54 lines
2.1 KiB
Desktop File
54 lines
2.1 KiB
Desktop File
# RELAY-PHASE1 · E (TASK E) — relay data-plane (P1) systemd unit. STAGING TEMPLATE.
|
|
#
|
|
# Runs the Phase-1 relay entry (relay-run/src/main-phase1.ts via `start:phase1`, added in B5): browser
|
|
# WSS on :443 (BIND_PORT) and agent mTLS on AGENT_BIND_PORT. Stateless / restart-safe (INV7) — all
|
|
# state is in Postgres/Redis, so bouncing this unit does NOT drop host registrations or kill PTYs.
|
|
#
|
|
# INSTALL (adjust the placeholder paths to your VPS):
|
|
# 1) clone the repo to /opt/web-terminal (or edit --prefix below)
|
|
# 2) install: sudo cp deploy/systemd/relay-data-plane.service /etc/systemd/system/
|
|
# 3) put the filled env at /etc/relay/relay.env (0600, owned by the service user)
|
|
# 4) sudo systemctl daemon-reload && sudo systemctl enable --now relay-data-plane.service
|
|
#
|
|
# The env file supplies BIND_HOST/BIND_PORT/TLS_*/AGENT_BIND_PORT/AGENT_CA_*/BASE_DOMAIN/
|
|
# RELAY_NODE_ID/RELAY_AUTH_VERIFY_PUBKEY/RELAY_TRUST_DOMAIN/PG_URL/REDIS_URL (see .env.example).
|
|
|
|
[Unit]
|
|
Description=web-terminal rendezvous-relay DATA PLANE (P1, Phase 1)
|
|
Documentation=file:///opt/web-terminal/docs/PLAN_RELAY_PHASE1.md
|
|
# Reads the SAME Postgres/Redis as the control-plane (routes, revocations, registries).
|
|
After=network-online.target docker.service relay-control-plane.service
|
|
Wants=network-online.target
|
|
Requires=docker.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=relay
|
|
Group=relay
|
|
WorkingDirectory=/opt/web-terminal
|
|
EnvironmentFile=/etc/relay/relay.env
|
|
# Runs relay-run "start:phase1" (relay-run/package.json -> tsx src/main-phase1.ts).
|
|
ExecStart=/usr/bin/env npm --prefix /opt/web-terminal/relay-run run start:phase1
|
|
Restart=always
|
|
RestartSec=3
|
|
TimeoutStopSec=20
|
|
KillSignal=SIGTERM
|
|
|
|
# Bind the privileged browser port :443 WITHOUT running as root (least privilege).
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
|
|
# --- hardening ---
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=full
|
|
ProtectHome=true
|
|
ProtectControlGroups=true
|
|
ProtectKernelTunables=true
|
|
RestrictSUIDSGID=true
|
|
# TLS keys + the pinned agent-CA bundle are read-only to the relay.
|
|
ReadOnlyPaths=/etc/relay
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|