zwitschi
5d81f617f0
- deploy.sh: clean-tree guard + git fetch && git pull --ff-only + optional dep reinstall + app.db --migrate + restart. - restart-service.sh: supervisor-agnostic restart (systemd or fallback), waits for an in-flight scan. - check_runtime_git.sh: proves no scan writes git-tracked runtime data. - ids.service: systemd unit template. - tests/test_deployment.py: stdlib unittest invariant tests for the deployment runtime-isolation guarantee.
42 lines
1.3 KiB
Desktop File
42 lines
1.3 KiB
Desktop File
# systemd unit template (D005) — intrusion-detection web UI.
|
|
#
|
|
# Install:
|
|
# - Replace /path/to/intrusion-detection and the User/Group.
|
|
# - Copy to /etc/systemd/system/ids.service
|
|
# - sudo systemctl daemon-reload && sudo systemctl enable --now ids
|
|
#
|
|
# The app binds to 127.0.0.1:<WEB_PORT>; it must NOT be exposed to the LAN.
|
|
#
|
|
# Restart policy: automatically restart on crash. `deploy/deploy.sh` restarts
|
|
# this unit after a successful `git pull`. Scans run in a background thread, so
|
|
# one (serialized) scan at a time; deploy waits for the worker to be idle
|
|
# (see restart-service.sh) before restarting.
|
|
|
|
[Unit]
|
|
Description=Intrusion Detection web UI + IDS scanner
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Run as an unprivileged user; the app only needs read access to the log dirs
|
|
# it consumes (COPYPARTY_LOG_PATH / NPM_LOG_PATH) and write access to its own
|
|
# data/ + reports/ + ids.db.
|
|
User=ids
|
|
Group=ids
|
|
WorkingDirectory=/path/to/intrusion-detection
|
|
EnvironmentFile=-/etc/ids.env
|
|
ExecStart=/path/to/intrusion-detection/.venv/bin/python /path/to/intrusion-detection/app.py
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Hardening
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
ProtectSystem=full
|
|
ProtectHome=no
|
|
ReadWritePaths=/path/to/intrusion-detection/data /path/to/intrusion-detection/reports /var/lib/ids
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|