chick
3473816167
agent 从 simadmin-relay 拆出来，作为公开仓库：安装命令要由节点执行，而节点没有凭据，所以 二进制必须放在匿名可读的地方，而 relay 源码与 IPA 继续私有。 拆出来之后有一处必须改，不是搬文件：`contracts/agent-policy.json` 原先由 relay 仓库拥有、 agent 侧是 vendored 副本（Makefile 从 `../contracts/` 拷、policy_test.go 断言两份相等）。 现在反过来——**agent 拥有策略**，因为 agent 是执行它的那一方，让它去拷贝一份住在别处的文件 本来就是别扭的。relay 保留 vendored 副本（它的限额从同一组数字推导），而两侧的一致性不再 靠构建期比较（跨仓库的构建期比较谁也做不了），改由运行时保证：agent 在握手时上报策略摘要， relay 拿自己那份比对，在 `/v1/status` 里逐节点给出 `policyMatches`。这比原来的测试更强， 因为它比的是**实际部署的那两份**，而不是两个 checkout 里的文件。 `contracts/test-vectors.json` 同理：Go 实现生成它（`make vectors`），relay 的 Node 参考实现 与 app 的 Swift 测试从 vendored 副本重算。实测重新生成的结果与 relay 那份逐字节相同。 systemd 单元的 `Documentation=` 指向本仓库。`VERSION` 提到 1.0.0。 20 个提交的历史完整保留（filter-branch 按子目录抽取）。
65 lines
2.1 KiB
Desktop File
65 lines
2.1 KiB
Desktop File
[Unit]
|
|
Description=MultiSimAdmin relay agent
|
|
Documentation=https://gitea.chickliu.fun/Hermes/msa-agent
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/opt/msa-agent/msa-agent --config /etc/msa-agent/config.json
|
|
Restart=always
|
|
# Backing off on our own is not enough: a relay that is down for an hour should not be hammered by
|
|
# every node in the fleet the moment it comes back.
|
|
RestartSec=5
|
|
TimeoutStopSec=20
|
|
KillSignal=SIGTERM
|
|
|
|
User=msa-agent
|
|
Group=msa-agent
|
|
|
|
# The agent needs almost nothing from the host. Everything below is a capability the process never
|
|
# uses, removed so that a compromise of the agent is not automatically a compromise of the box.
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
PrivateUsers=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RemoveIPC=yes
|
|
UMask=0077
|
|
|
|
# Configuration and the audit log are the only writable paths. ReadWritePaths is what keeps
|
|
# ProtectSystem=strict from making the audit log unwritable.
|
|
ReadWritePaths=/var/log/msa-agent
|
|
ConfigurationDirectory=msa-agent
|
|
LogsDirectory=msa-agent
|
|
|
|
# AF_INET and AF_INET6 only: the agent dials out to the relay and to 127.0.0.1, so it has no reason
|
|
# to reach a Unix socket, a netlink family or a packet socket.
|
|
#
|
|
# No IPAddressDeny / IPAddressAllow pair here, deliberately. It reads like the obvious way to pin the
|
|
# agent to loopback, and it is wrong: those directives filter both directions, so IPAddressDeny=any
|
|
# would also cut the outbound connection to the relay the agent exists to maintain. The loopback
|
|
# invariant is enforced in code by internal/egress, which is testable, rather than by a directive
|
|
# that silently breaks the only path out.
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
# No capability at all, so the process cannot even ask to bind a privileged port.
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|