v0.25.0

deploy/rustproxy.service

@@ -14,7 +14,7 @@ Environment=RUST_LOG=rust_proxy=info,warn
 Environment=MALLOC_ARENA_MAX=2
 Environment=PATH=/opt/rustproxy-certbot/bin:/usr/local/bin:/usr/bin:/bin
 EnvironmentFile=-/etc/rustproxy/environment
-ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443 --allow-remote-admin
+ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443
 Restart=on-failure
 RestartSec=3
 KillSignal=SIGINT
@@ -24,6 +24,7 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
 PrivateTmp=true
+PrivateDevices=true
 ProtectSystem=strict
 LogsDirectory=rustproxy
 LogsDirectoryMode=0770
@@ -31,9 +32,13 @@ ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
 ProtectHome=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
+ProtectKernelLogs=true
 ProtectControlGroups=true
 RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictRealtime=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
 LockPersonality=true
 
 [Install]