42034c0ff9
- Convert NostrVPN from container app to native systemd service - Auto-configure VPN with node's Nostr identity after onboarding - Add nostr-vpn.service with proper capabilities (NET_ADMIN, NET_RAW) - Remove FIPS from marketplace, container config, nginx, image-versions (consolidated into NostrVPN — same mesh VPN concept) - Add AIUI inclusion step to dev CI workflow - AIUI installed on VPS build server for ISO inclusion Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
40 lines
1.0 KiB
Desktop File
40 lines
1.0 KiB
Desktop File
[Unit]
|
|
Description=Nostr VPN - Mesh VPN with Nostr identity
|
|
After=network-online.target tor.service archipelago.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
EnvironmentFile=-/var/lib/archipelago/nostr-vpn/env
|
|
ExecStartPre=/bin/bash -c 'test -f /var/lib/archipelago/nostr-vpn/env || { echo "NostrVPN not configured — waiting for onboarding"; exit 1; }'
|
|
ExecStart=/usr/local/bin/nvpn daemon
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
TimeoutStartSec=30
|
|
TimeoutStopSec=10
|
|
|
|
# Networking capabilities (required for TUN/WireGuard)
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE
|
|
|
|
# Security hardening
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/archipelago/nostr-vpn /run/nostr-vpn /dev/net/tun
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
RestrictRealtime=yes
|
|
|
|
# Resource limits
|
|
MemoryMax=256M
|
|
TasksMax=64
|
|
|
|
# Logging
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|