iamdoubz
60348cf0c5
Settings → Network makes a key, shown once and stored encrypted; the api sends it to the probe as a Bearer token, and a new probe address drops it. A probe with PROBE_KEY only answers that key. Without one it stays open, and Diagnostics strongly recommends setting it.
40 lines
1.3 KiB
Desktop File
40 lines
1.3 KiB
Desktop File
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
# The network test probe (08 §2.6) as a service, without Docker. With the downloaded executable at
|
|
# /usr/local/bin/selfphoneng-probe:
|
|
# sudo cp selfphoneng-probe.service /etc/systemd/system/
|
|
# sudo systemctl enable --now selfphoneng-probe
|
|
# sudo ufw allow 8080/tcp
|
|
[Unit]
|
|
Description=SelfPhoneNG network test probe
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
ExecStart=/usr/local/bin/selfphoneng-probe
|
|
Environment=PORT=8080
|
|
# Strongly recommended: SelfPhoneNG → Settings → Network → Generate key, then uncomment and paste
|
|
# it; the probe then only answers your server.
|
|
#Environment=PROBE_KEY=
|
|
# Behind your own HTTPS reverse proxy on this machine that sets X-Forwarded-For: PORT to a local
|
|
# one, and TRUST_PROXY=true (it then listens on 127.0.0.1 only; HOST changes that).
|
|
#Environment=TRUST_PROXY=true
|
|
Restart=always
|
|
RestartSec=5
|
|
# It needs nothing but the network: no files, no privileges.
|
|
DynamicUser=yes
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
LockPersonality=yes
|
|
MemoryMax=200M
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|