archipelago
c1036eb195
Stopped for user-requested handover before validation. Draft offline provisioner, owned nft tables, service ordering, runtime Debian sources and update-writer masks. Not qualified or ready for integration: FIPS WireGuard allowance, drop-in writer parity, namespace regressions, image hooks and policy documentation remain pending. No installed host or network changes.
32 lines
773 B
Desktop File
32 lines
773 B
Desktop File
[Unit]
|
|
Description=Archipelago owned host and FIPS default-deny firewall
|
|
DefaultDependencies=no
|
|
After=local-fs.target
|
|
Before=network-pre.target shutdown.target
|
|
Wants=network-pre.target
|
|
Conflicts=shutdown.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/bin/python3 -I -B /usr/libexec/archipelago-host-firewall
|
|
ExecReload=/usr/bin/python3 -I -B /usr/libexec/archipelago-host-firewall
|
|
# Stop never removes protection or flushes other controllers' rules.
|
|
User=root
|
|
Group=root
|
|
UMask=0077
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ReadWritePaths=/run
|
|
CapabilityBoundingSet=CAP_NET_ADMIN
|
|
RestrictAddressFamilies=AF_UNIX AF_NETLINK
|
|
TimeoutStartSec=45
|
|
MemoryMax=64M
|
|
TasksMax=8
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|