v0.25.0

deploy/README.md

@@ -26,15 +26,15 @@ After starting through your service manager, run account/certificate CLI operati
 as the same service account with `--data-dir /var/lib/rustproxy`. The example
 uses `ProtectHome=true`, so certificate files intended for runtime use must be in
 the data directory, not in a home directory. Use an SSH tunnel to access the local
-admin port remotely. This reference unit deliberately binds administration to `0.0.0.0:9090` with
-`--allow-remote-admin`. It is plain HTTP and must be limited by firewall/private-network
-policy. The normal installer remains loopback-safe unless that flag is explicitly supplied. For a systemd drop-in, reset `ExecStart`
-before replacing it:
+admin port remotely. This reference unit keeps administration on `127.0.0.1:9090`; public HTTP/HTTPS
+listeners remain explicit. For direct remote administration, enable Administration HTTPS and persist
+a non-loopback bind from the panel rather than exposing the plain-HTTP bootstrap listener. For a
+systemd drop-in, reset `ExecStart` before replacing it. Example preserving the loopback-safe admin:
 
 ```ini
 [Service]
 ExecStart=
-ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443 --allow-remote-admin
+ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443
 ReadWritePaths=/var/log/rustproxy
 ```
 

deploy/rustproxy.service

@@ -14,7 +14,7 @@ Environment=RUST_LOG=rust_proxy=info,warn
 Environment=MALLOC_ARENA_MAX=2
 Environment=PATH=/opt/rustproxy-certbot/bin:/usr/local/bin:/usr/bin:/bin
 EnvironmentFile=-/etc/rustproxy/environment
-ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443 --allow-remote-admin
+ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443
 Restart=on-failure
 RestartSec=3
 KillSignal=SIGINT
@@ -24,6 +24,7 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
 PrivateTmp=true
+PrivateDevices=true
 ProtectSystem=strict
 LogsDirectory=rustproxy
 LogsDirectoryMode=0770
@@ -31,9 +32,13 @@ ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
 ProtectHome=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
+ProtectKernelLogs=true
 ProtectControlGroups=true
 RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictRealtime=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
 LockPersonality=true
 
 [Install]