v0,28,2

deploy/README.md

@@ -36,6 +36,7 @@ systemd drop-in, reset `ExecStart` before replacing it. Example preserving the l
 ExecStart=
 ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443
 ReadWritePaths=/var/log/rustproxy
+ReadOnlyPaths=-/etc/letsencrypt -/etc/ssl
 ```
 
 Saving HTTP/TLS or TCP/UDP stream listener changes in the UI does not restart this service. Restart explicitly
@@ -45,3 +46,12 @@ bind can prevent startup; preserve a pre-change database backup and consult
 `systemd-analyze verify` and exercise actual non-root binding before accepting a
 production deployment. This packaging environment did not run systemd or bind
 privileged ports through this unit.
+
+External certificate files under `/etc/letsencrypt` or `/etc/ssl` remain read-only under the systemd sandbox. `ReadOnlyPaths=` does not grant Unix permissions; use narrow POSIX ACLs for the `rustproxy` user. For traversal of a protected root, for example:
+
+```bash
+setfacl -m u:rustproxy:--x /etc/ssl/
+```
+
+Grant `r--` only on the certificate/key files RustProxy actually needs; never grant write access to the service identity.
+If Certbot or another renewer recreates a key as `0600`, reapply the named file ACL to the newly resolved target in the renewal hook before calling the RustProxy reload API.