v0.24.5
This commit is contained in:
gru committed
commit
5e23e9af02
240 files changed
+99957
No files matched your search
Vendored
+60
@@ -0,0 +1,60 @@
|
||||
# Debian packaging
|
||||
|
||||
This directory builds the `rustproxy` binary package for RustProxy 0.24.5.
|
||||
The package installs:
|
||||
|
||||
- `/usr/bin/rust-proxy`
|
||||
- `/etc/rustproxy/environment` (conffile)
|
||||
- `rustproxy.service`
|
||||
- logrotate policy for `/var/log/rustproxy`
|
||||
- Grafana dashboard under `/usr/share/rustproxy/grafana/`
|
||||
|
||||
The service runs as the unprivileged `rustproxy` system user. `CAP_NET_BIND_SERVICE`
|
||||
is the only ambient/bounding capability, allowing ports 80/443 without root. The
|
||||
administration listener is loopback-only by default. systemd and `postinst` both
|
||||
ensure `/var/lib/rustproxy` and `/var/log/rustproxy` exist with mode `0750`.
|
||||
|
||||
## Build the `.deb`
|
||||
|
||||
Install build prerequisites (including Rust 1.88+), then from the source tree:
|
||||
|
||||
```bash
|
||||
./debian/build-package.sh
|
||||
```
|
||||
|
||||
The script uses the committed `Cargo.lock`, runs `cargo fetch --locked`, invokes
|
||||
`dpkg-buildpackage -us -uc -b`, and copies generated package artifacts to `dist/`.
|
||||
If dependencies are pre-fetched/vendored, set `CARGO_NET_OFFLINE=true` for an
|
||||
offline Cargo build.
|
||||
|
||||
## Repository for rustproxy.linuxiarz.pl
|
||||
|
||||
Install repository tooling:
|
||||
|
||||
```bash
|
||||
apt install dpkg-dev apt-utils gzip gnupg
|
||||
```
|
||||
|
||||
Build the repository:
|
||||
|
||||
```bash
|
||||
RUSTPROXY_REPO_GPG_KEY='<fingerprint-or-key-id>' ./debian/build-repository.sh
|
||||
```
|
||||
|
||||
Publish the generated `repository/` directory at the web root of
|
||||
`https://rustproxy.linuxiarz.pl/`. Export the public repository key separately and
|
||||
install it on clients as `/usr/share/keyrings/rustproxy.gpg`, then use:
|
||||
|
||||
```text
|
||||
deb [signed-by=/usr/share/keyrings/rustproxy.gpg] https://rustproxy.linuxiarz.pl stable main
|
||||
```
|
||||
|
||||
The repository script emits `Packages`, maximum-gzip `Packages.gz`, `Release`, and,
|
||||
when a GPG key is configured, `Release.gpg` plus `InRelease`.
|
||||
|
||||
## Logs
|
||||
|
||||
Structured file logging defaults to `/var/log/rustproxy/access.jsonl` when enabled
|
||||
in RustProxy. Logrotate runs daily, keeps at most three days, compresses immediately
|
||||
with `gzip -9`, and uses `copytruncate` because RustProxy owns the open log file.
|
||||
Systemd journal output remains independent of this JSONL rotation.
|
||||
+26
@@ -0,0 +1,26 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
cd "$ROOT"
|
||||
|
||||
for tool in cargo rustc dpkg-buildpackage; do
|
||||
command -v "$tool" >/dev/null 2>&1 || { echo "Missing build tool: $tool" >&2; exit 2; }
|
||||
done
|
||||
|
||||
RUSTC_VERSION=$(rustc --version | awk '{print $2}')
|
||||
if ! dpkg --compare-versions "$RUSTC_VERSION" ge 1.88; then
|
||||
echo "RustProxy requires rustc >= 1.88 (found $RUSTC_VERSION)" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
# Fetch against Cargo.lock before the Debian build. Use CARGO_NET_OFFLINE=true
|
||||
# when the registry/cache has already been prepared or dependencies are vendored.
|
||||
cargo fetch --locked
|
||||
|
||||
dpkg-buildpackage -us -uc -b
|
||||
|
||||
mkdir -p dist
|
||||
find .. -maxdepth 1 -type f \( -name 'rustproxy_0.24.5_*.deb' -o -name 'rustproxy_0.24.5_*.changes' -o -name 'rustproxy_0.24.5_*.buildinfo' \) \
|
||||
-exec cp -f {} dist/ \;
|
||||
echo "Packages copied to $ROOT/dist"
|
||||
+44
@@ -0,0 +1,44 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
REPO=${1:-"$ROOT/repository"}
|
||||
DEBS=${2:-"$ROOT/dist"}
|
||||
ARCH=${RUSTPROXY_REPO_ARCH:-$(dpkg --print-architecture)}
|
||||
CODENAME=${RUSTPROXY_REPO_CODENAME:-stable}
|
||||
COMPONENT=${RUSTPROXY_REPO_COMPONENT:-main}
|
||||
|
||||
for tool in dpkg-scanpackages apt-ftparchive gzip; do
|
||||
command -v "$tool" >/dev/null 2>&1 || { echo "Missing repository tool: $tool" >&2; exit 2; }
|
||||
done
|
||||
|
||||
POOL="$REPO/pool/$COMPONENT/r/rustproxy"
|
||||
BINARY="$REPO/dists/$CODENAME/$COMPONENT/binary-$ARCH"
|
||||
mkdir -p "$POOL" "$BINARY"
|
||||
find "$DEBS" -maxdepth 1 -type f -name 'rustproxy_*.deb' -exec cp -f {} "$POOL/" \;
|
||||
|
||||
cd "$REPO"
|
||||
dpkg-scanpackages --arch "$ARCH" "pool/$COMPONENT" /dev/null > "dists/$CODENAME/$COMPONENT/binary-$ARCH/Packages"
|
||||
gzip -9 -n -c "dists/$CODENAME/$COMPONENT/binary-$ARCH/Packages" > "dists/$CODENAME/$COMPONENT/binary-$ARCH/Packages.gz"
|
||||
apt-ftparchive \
|
||||
-o APT::FTPArchive::Release::Origin=RustProxy \
|
||||
-o APT::FTPArchive::Release::Label=RustProxy \
|
||||
-o APT::FTPArchive::Release::Suite="$CODENAME" \
|
||||
-o APT::FTPArchive::Release::Codename="$CODENAME" \
|
||||
-o APT::FTPArchive::Release::Architectures="$ARCH" \
|
||||
-o APT::FTPArchive::Release::Components="$COMPONENT" \
|
||||
release "dists/$CODENAME" > "dists/$CODENAME/Release"
|
||||
|
||||
if [ -n "${RUSTPROXY_REPO_GPG_KEY:-}" ]; then
|
||||
command -v gpg >/dev/null 2>&1 || { echo "RUSTPROXY_REPO_GPG_KEY is set but gpg is missing" >&2; exit 2; }
|
||||
gpg --batch --yes --local-user "$RUSTPROXY_REPO_GPG_KEY" --armor --detach-sign \
|
||||
--output "dists/$CODENAME/Release.gpg" "dists/$CODENAME/Release"
|
||||
gpg --batch --yes --local-user "$RUSTPROXY_REPO_GPG_KEY" --clearsign \
|
||||
--output "dists/$CODENAME/InRelease" "dists/$CODENAME/Release"
|
||||
else
|
||||
rm -f "dists/$CODENAME/Release.gpg" "dists/$CODENAME/InRelease"
|
||||
echo "WARNING: repository is unsigned. Set RUSTPROXY_REPO_GPG_KEY for production." >&2
|
||||
fi
|
||||
|
||||
echo "Repository ready: $REPO"
|
||||
echo "Publish this directory as https://rustproxy.linuxiarz.pl/"
|
||||
Vendored
+197
@@ -0,0 +1,197 @@
|
||||
rustproxy (0.24.5) stable; urgency=medium
|
||||
|
||||
* Fix empty HTTP/3 request-body forwarding to HTTP/1.1 upstreams, including DELETE.
|
||||
* Preserve streaming for non-empty H3 request bodies and existing H1/H2 behavior.
|
||||
|
||||
-- RustProxy Release <release@localhost> Fri, 02 Oct 2026 23:27:00 +0200
|
||||
|
||||
rustproxy (0.24.4) stable; urgency=medium
|
||||
|
||||
* Disable Transparent Huge Pages locally for the RustProxy Linux process before Tokio startup.
|
||||
* Keep host THP policy unchanged and retain existing glibc arena/trim tuning.
|
||||
|
||||
-- RustProxy Release <release@localhost> Fri, 02 Oct 2026 15:20:00 +0200
|
||||
|
||||
rustproxy (0.24.3) stable; urgency=medium
|
||||
|
||||
* Reduce glibc allocator retention and transformation-path temporary allocations.
|
||||
* Move HTTP/3 enablement to Listeners while retaining dedicated QUIC tuning.
|
||||
* Hide unsupported process diagnostics dynamically in the dashboard.
|
||||
|
||||
-- RustProxy Release <release@localhost> Fri, 02 Oct 2026 09:45:00 +0200
|
||||
|
||||
rustproxy (0.24.2) stable; urgency=medium
|
||||
|
||||
* Version-only release bump; no functional changes from 0.24.1.
|
||||
|
||||
-- RustProxy Release <release@localhost> Thu, 01 Oct 2026 22:11:00 +0200
|
||||
|
||||
rustproxy (0.24.1) stable; urgency=medium
|
||||
|
||||
* Use shared cross-platform statistics APIs and expose more portable metrics.
|
||||
* Add authenticated runtime path metadata and platform-aware installed-data discovery.
|
||||
* Move Logging into Settings while retaining legacy navigation compatibility.
|
||||
|
||||
-- RustProxy Release <release@localhost> Thu, 01 Oct 2026 21:00:00 +0200
|
||||
|
||||
rustproxy (0.24.0) stable; urgency=medium
|
||||
|
||||
* Graceful HTTP/2 GOAWAY/drain shutdown with independent idle, lifetime and drain limits.
|
||||
* Extract system statistics backends and add BSD platform support plus process platform reporting.
|
||||
|
||||
-- RustProxy Release <release@localhost> Thu, 01 Oct 2026 18:46:00 +0200
|
||||
|
||||
rustproxy (0.23.3) stable; urgency=medium
|
||||
|
||||
* Add opt-in per-vhost legacy WebSocket compatibility for older appliances.
|
||||
* Align legacy WebSocket Origin/Host and tolerate legacy 101 response framing.
|
||||
|
||||
-- RustProxy Maintainers <noreply@localhost> Thu, 01 Oct 2026 00:00:00 +0000
|
||||
|
||||
rustproxy (0.23.2) stable; urgency=medium
|
||||
|
||||
* Add configurable live-chart history windows for Cache and Transformation.
|
||||
* Fix HTTPS administration transport handling for --livelogs and local CLI API calls.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Thu, 01 Oct 2026 11:36:19 +0200
|
||||
|
||||
rustproxy (0.23.1) stable; urgency=medium
|
||||
|
||||
* Add collapsible full-width live Cache and Transform activity charts.
|
||||
* Update package and administration UI identity to 0.23.1.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Thu, 01 Oct 2026 11:11:00 +0200
|
||||
|
||||
rustproxy (0.23.0) stable; urgency=medium
|
||||
|
||||
* Add HTTP/1.1 Upgrade: h2c and external certificate hot-deploy/reload support.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Thu, 01 Oct 2026 08:30:00 +0200
|
||||
|
||||
rustproxy (0.22.2) stable; urgency=medium
|
||||
|
||||
* Add replay-safe backend failover retry with bounded policy and metrics.
|
||||
* Correct explicit HTTP/2 upstream request handling and add H2 regression coverage.
|
||||
* Add vhost retry controls to the administration UI and OpenAPI schema.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Thu, 01 Oct 2026 07:10:00 +0200
|
||||
|
||||
rustproxy (0.22.1) stable; urgency=medium
|
||||
|
||||
* Add HTTP/2 RFC 8441 WebSocket transport and opt-in h2c prior-knowledge listeners.
|
||||
* Add active tunnel inventory/kill administration with audit and H1/H2/H3 metrics.
|
||||
* Move selective PURGE/BAN workflows into modal UI and fix null-safe operation feedback.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Wed, 30 Sep 2026 22:45:00 +0200
|
||||
|
||||
rustproxy (0.22.0) stable; urgency=medium
|
||||
|
||||
* Add cache request collapsing, single-range HTTP 206 reuse, selective PURGE/BAN,
|
||||
configurable stale-if-error classes and proactive cache refresh.
|
||||
* Extend the authenticated cache API, dashboard, metrics and regression coverage.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Wed, 30 Sep 2026 21:00:00 +0200
|
||||
|
||||
rustproxy (0.21.0) stable; urgency=medium
|
||||
|
||||
* Add sharded Cold Cache with bounded asynchronous garbage collection.
|
||||
* Implement RFC 5861 stale handling and request max-stale semantics.
|
||||
* Add per-vhost static-response transformations before cache/compression.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Tue, 29 Sep 2026 21:25:00 +0200
|
||||
|
||||
rustproxy (0.20.0) stable; urgency=medium
|
||||
|
||||
* Split Certificates into Installed, Renewal and Generate tabs.
|
||||
* Improve ACME renewal status and failed-operation messages.
|
||||
* Show exact private Certbot log directories for certificate failures.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Tue, 29 Sep 2026 12:14:00 +0200
|
||||
|
||||
rustproxy (0.19.4) stable; urgency=medium
|
||||
|
||||
* Align Docker-vhost Aliases with neighboring form controls.
|
||||
* Preserve sub-0.1 KiB/s backend traffic rendering.
|
||||
* Add cache-domain filtering by effective cache state.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Tue, 29 Sep 2026 11:30:00 +0200
|
||||
|
||||
rustproxy (0.19.3) stable; urgency=medium
|
||||
|
||||
* Preserve exact Settings location across re-login and browser refresh.
|
||||
* Add shared saving state, field-focused validation and unsaved-tab markers.
|
||||
* Keep certificate import file selections after failed saves.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Tue, 29 Sep 2026 09:32:00 +0200
|
||||
|
||||
rustproxy (0.19.2) stable; urgency=medium
|
||||
|
||||
* Improve default-response status labels and Live-log buffering.
|
||||
* Polish checkbox/alias layout and backend rate formatting.
|
||||
* Keep local pages non-cacheable and allow guarded vhost-ID renames.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Mon, 28 Sep 2026 23:26:00 +0200
|
||||
|
||||
rustproxy (0.19.1) stable; urgency=medium
|
||||
|
||||
* Fix Default responses saves and isolate cache objects by frontend scheme.
|
||||
* Retain on-demand Live Logs history and polish traffic/checkbox/Docker Advanced UI.
|
||||
* Remove stale screenshots and update documentation/release contracts.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Mon, 28 Sep 2026 22:14:00 +0200
|
||||
|
||||
rustproxy (0.19.0) stable; urgency=medium
|
||||
|
||||
* Persist per-admin Live Logs column visibility in SQLite while keeping full JSON exports.
|
||||
* Fix disabled backend TLS verification for legacy X.509 certificates and retain detailed upstream diagnostics.
|
||||
* Remove the duplicate version label from the top-right dashboard toolbar.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Mon, 28 Sep 2026 14:55:00 +0200
|
||||
|
||||
rustproxy (0.18.8) stable; urgency=medium
|
||||
|
||||
* Add Docker-vhost alias chips plus redirect, WebSocket and cache controls.
|
||||
* Add a Docker-agent default ACL profile and remove the Overview codec explainer.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Mon, 28 Sep 2026 12:43:00 +0200
|
||||
|
||||
rustproxy (0.18.7) stable; urgency=medium
|
||||
|
||||
* Polish Overview network charts and collapse response-time history by default.
|
||||
* Align expanded Docker-vhost routing and ACL controls.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Mon, 28 Sep 2026 12:05:00 +0200
|
||||
|
||||
rustproxy (0.18.6) stable; urgency=medium
|
||||
|
||||
* Fix compression/protocol telemetry and improve Docker/backend dashboard UX.
|
||||
* Remove the Open proxy shortcut and make Compact density materially tighter.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Mon, 28 Sep 2026 10:36:37 +0200
|
||||
|
||||
rustproxy (0.18.4) stable; urgency=medium
|
||||
|
||||
* Default backend health checks to TCP and streamline Docker vhost/Security UX.
|
||||
* Move administration audit to an on-demand modal.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Mon, 28 Sep 2026 09:45:00 +0200
|
||||
|
||||
rustproxy (0.18.3) stable; urgency=medium
|
||||
|
||||
* Separate Docker vhost/backend Prometheus metric families and collector group.
|
||||
|
||||
-- RustProxy Maintainers <root@localhost> Sun, 27 Sep 2026 17:45:00 +0200
|
||||
|
||||
rustproxy (0.18.2) stable; urgency=medium
|
||||
|
||||
* Add optional Docker-agent discovery and dynamic Docker vhost assignments.
|
||||
* Remove revision-header exposure and refresh dashboard/settings UX.
|
||||
|
||||
-- RustProxy package maintainer <packages@rustproxy.linuxiarz.pl> Sun, 27 Sep 2026 15:06:00 +0200
|
||||
|
||||
rustproxy (0.17.0) stable; urgency=medium
|
||||
|
||||
* Package RustProxy 0.17.0 with a hardened systemd service, log rotation,
|
||||
Prometheus/Grafana assets and local-response host support.
|
||||
|
||||
-- RustProxy package maintainer <packages@rustproxy.linuxiarz.pl> Sat, 27 Sep 2026 11:35:00 +0200
|
||||
Vendored
+16
@@ -0,0 +1,16 @@
|
||||
Source: rustproxy
|
||||
Section: net
|
||||
Priority: optional
|
||||
Maintainer: RustProxy package maintainer <packages@rustproxy.linuxiarz.pl>
|
||||
Build-Depends: debhelper-compat (= 13), cargo, rustc (>= 1.88), pkg-config, libsqlite3-dev
|
||||
Standards-Version: 4.7.0
|
||||
Rules-Requires-Root: no
|
||||
Homepage: https://rustproxy.linuxiarz.pl
|
||||
|
||||
Package: rustproxy
|
||||
Architecture: any
|
||||
Depends: ${shlibs:Depends}, ${misc:Depends}, adduser, ca-certificates, logrotate, gzip
|
||||
Description: independent Rust reverse proxy with local administration
|
||||
RustProxy is an independent reverse proxy with HTTP/1.1, HTTP/2, HTTP/3,
|
||||
WebSocket, TLS, caching, redirects, local response hosts, TCP/UDP streams,
|
||||
diagnostics and a local administration dashboard.
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
#!/usr/bin/make -f
|
||||
|
||||
export DEB_BUILD_MAINT_OPTIONS = hardening=+all
|
||||
export CARGO_TERM_COLOR = never
|
||||
|
||||
%:
|
||||
dh $@
|
||||
|
||||
override_dh_auto_configure:
|
||||
# Cargo is the authoritative build system; no generated configure step.
|
||||
|
||||
override_dh_auto_build:
|
||||
cargo build --release --locked
|
||||
|
||||
override_dh_auto_test:
|
||||
ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
|
||||
cargo test --locked
|
||||
endif
|
||||
|
||||
override_dh_auto_install:
|
||||
install -D -m0755 target/release/rust-proxy debian/rustproxy/usr/bin/rust-proxy
|
||||
install -D -m0640 debian/rustproxy.environment debian/rustproxy/etc/rustproxy/environment
|
||||
install -D -m0644 grafana/rustproxy-overview.json debian/rustproxy/usr/share/rustproxy/grafana/rustproxy-overview.json
|
||||
install -D -m0644 grafana/README.md debian/rustproxy/usr/share/doc/rustproxy/grafana/README.md
|
||||
Vendored
+7
@@ -0,0 +1,7 @@
|
||||
# RustProxy Debian package defaults.
|
||||
# systemctl restart rustproxy after changing listener environment values.
|
||||
RUST_LOG=rust_proxy=info,warn
|
||||
RUST_PROXY_DATA_DIR=/var/lib/rustproxy
|
||||
RUST_PROXY_ADMIN_LISTEN=127.0.0.1:9090
|
||||
RUST_PROXY_PROXY_LISTEN=0.0.0.0:80
|
||||
RUST_PROXY_TLS_LISTEN=0.0.0.0:443
|
||||
Vendored
+15
@@ -0,0 +1,15 @@
|
||||
/var/log/rustproxy/*.jsonl /var/log/rustproxy/*.log /var/log/rustproxy/vhosts/*.jsonl {
|
||||
daily
|
||||
rotate 3
|
||||
maxage 3
|
||||
missingok
|
||||
notifempty
|
||||
compress
|
||||
compresscmd /usr/bin/gzip
|
||||
compressext .gz
|
||||
compressoptions -9
|
||||
dateext
|
||||
dateformat -%Y%m%d
|
||||
copytruncate
|
||||
su rustproxy rustproxy
|
||||
}
|
||||
+14
@@ -0,0 +1,14 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
if ! getent group rustproxy >/dev/null 2>&1; then
|
||||
addgroup --system rustproxy >/dev/null
|
||||
fi
|
||||
if ! getent passwd rustproxy >/dev/null 2>&1; then
|
||||
adduser --system --ingroup rustproxy --home /var/lib/rustproxy --no-create-home \
|
||||
--disabled-password --shell /usr/sbin/nologin rustproxy >/dev/null
|
||||
fi
|
||||
install -d -o rustproxy -g rustproxy -m 0750 /var/lib/rustproxy /var/log/rustproxy
|
||||
|
||||
#DEBHELPER#
|
||||
exit 0
|
||||
Vendored
+55
@@ -0,0 +1,55 @@
|
||||
[Unit]
|
||||
Description=RustProxy reverse proxy
|
||||
Documentation=https://rustproxy.linuxiarz.pl
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=rustproxy
|
||||
Group=rustproxy
|
||||
WorkingDirectory=/var/lib/rustproxy
|
||||
Environment=MALLOC_ARENA_MAX=2
|
||||
EnvironmentFile=-/etc/rustproxy/environment
|
||||
ExecStart=/usr/bin/rust-proxy serve
|
||||
Restart=on-failure
|
||||
RestartSec=3s
|
||||
KillSignal=SIGINT
|
||||
KillMode=control-group
|
||||
TimeoutStopSec=120s
|
||||
UMask=0027
|
||||
|
||||
# Bind 80/443 without running the service as root.
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
||||
NoNewPrivileges=true
|
||||
|
||||
# Runtime filesystem policy. Diagnostics intentionally retain normal /proc access.
|
||||
StateDirectory=rustproxy
|
||||
StateDirectoryMode=0750
|
||||
LogsDirectory=rustproxy
|
||||
LogsDirectoryMode=0750
|
||||
RuntimeDirectory=rustproxy
|
||||
RuntimeDirectoryMode=0750
|
||||
ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
PrivateTmp=true
|
||||
PrivateDevices=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectKernelLogs=true
|
||||
ProtectControlGroups=true
|
||||
LockPersonality=true
|
||||
RestrictRealtime=true
|
||||
RestrictSUIDSGID=true
|
||||
RestrictNamespaces=true
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
SystemCallArchitectures=native
|
||||
|
||||
# High enough for many frontend/upstream sockets without removing all limits.
|
||||
LimitNOFILE=65536
|
||||
TasksMax=4096
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Vendored
+2
@@ -0,0 +1,2 @@
|
||||
d /var/lib/rustproxy 0750 rustproxy rustproxy -
|
||||
d /var/log/rustproxy 0750 rustproxy rustproxy -
|
||||
Vendored
+1
@@ -0,0 +1 @@
|
||||
3.0 (native)
|
||||
Reference in new issue
Block a user