v.34.1

deploy/README.md

@@ -1,7 +1,7 @@
 # Example Linux service
 
 `rustproxy.service` is an operator-reviewed deployment example, not an installed or
-tested service. It runs the compiled executable as a dedicated `rustproxy` account,
+tested service. With RustProxy 0.34.1, the example includes `ExecReload` so `systemctl reload rustproxy` uses the authenticated CLI soft reload. If using `RUST_PROXY_CONFIG`, configure it in the service EnvironmentFile so both `ExecStart` and `ExecReload` share the same file source. It runs the compiled executable as a dedicated `rustproxy` account,
 uses the public administration profile shown below and grants only the capability needed
 for low-port binding. It does not run the proxy as root or grant Docker socket access.
 

deploy/rustproxy.service

@@ -15,6 +15,7 @@ Environment=MALLOC_ARENA_MAX=2
 Environment=PATH=/usr/local/bin:/usr/bin:/bin
 EnvironmentFile=-/etc/rustproxy/environment
 ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443 --allow-remote-admin
+ExecReload=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload
 Restart=on-failure
 RestartSec=3
 KillSignal=SIGINT
@@ -28,7 +29,7 @@ PrivateDevices=true
 ProtectSystem=strict
 LogsDirectory=rustproxy
 LogsDirectoryMode=0770
-ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
+ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy -/etc/rustproxy
 ReadOnlyPaths=-/etc/letsencrypt -/etc/ssl
 ProtectHome=true
 ProtectKernelTunables=true