v0.3

deploy/README.md

@@ -1,7 +1,7 @@
 # Example Linux service
 
 `rustproxy.service` is an operator-reviewed deployment example, not an installed or
-tested service. With RustProxy 0.34.1, the example includes `ExecReload` so `systemctl reload rustproxy` uses the authenticated CLI soft reload. If using `RUST_PROXY_CONFIG`, configure it in the service EnvironmentFile so both `ExecStart` and `ExecReload` share the same file source. It runs the compiled executable as a dedicated `rustproxy` account,
+tested service. With RustProxy 0.34.2, the example includes `ExecReload` so `systemctl reload rustproxy` uses the authenticated CLI soft reload. If using `RUST_PROXY_CONFIG`, configure it in the service EnvironmentFile so both `ExecStart` and `ExecReload` share the same file source. It runs the compiled executable as a dedicated `rustproxy` account,
 uses the public administration profile shown below and grants only the capability needed
 for low-port binding. It does not run the proxy as root or grant Docker socket access.
 
@@ -47,6 +47,32 @@ bind can prevent startup; preserve a pre-change database backup and consult
 production deployment. This packaging environment did not run systemd or bind
 privileged ports through this unit.
 
+## Optional JSON backing file (`--config`)
+
+Use `sudo systemctl edit rustproxy` to override the startup command, **not** to edit the packaged unit directly. For the `/usr/bin` installation requested below (switch to `/opt/rustproxy/current/rust-proxy` on the managed deployment), configure:
+
+```ini
+[Service]
+ExecStart=
+ExecStart=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443 --allow-remote-admin --config /etc/rustproxy/config.json
+ReadWritePaths=/etc/rustproxy
+```
+
+Only activate after exporting a complete, valid JSON config. The directory and initial file may remain `root:root`, restricted to `0700` and `0600`; use:
+
+```bash
+sudo chown root:root /etc/rustproxy /etc/rustproxy/config.json
+sudo chmod 0700 /etc/rustproxy
+sudo chmod 0600 /etc/rustproxy/config.json
+sudo setfacl -m u:rustproxy:rwx /etc/rustproxy
+sudo setfacl -m u:rustproxy:rw- /etc/rustproxy/config.json
+sudo getfacl /etc/rustproxy /etc/rustproxy/config.json
+```
+
+**Atomic panel saves replace the file**: the service needs directory traversal/create/rename permission (`rwx`), not just file write. New config files are written `0600`, normally owned by `rustproxy`; do not assume named file ACLs survive replacement. `ProtectSystem=strict` additionally requires `ReadWritePaths=/etc/rustproxy` in the unit; ACLs do not override the systemd sandbox. Keep the original private data directory and SQLite state. Check the active source in **Settings → Manual config**, inspect the unit with `systemctl cat rustproxy`, then `systemctl restart rustproxy` and verify a save. An external JSON edit needs `systemctl reload rustproxy`; there is no automatic file watching.
+
+**Security:** the shown `0.0.0.0:9090` requires administration HTTPS and network access controls before remote exposure; use loopback administration otherwise. The complete export, privilege commands, validation and rollback guidance live in [Installation](../docs/INSTALL.md#optional-systemd-json-configuration).
+
 External certificate files under `/etc/letsencrypt` or `/etc/ssl` remain read-only under the systemd sandbox. `ReadOnlyPaths=` does not grant Unix permissions; use narrow POSIX ACLs for the `rustproxy` user. For traversal of a protected root, for example:
 
 ```bash

deploy/rustproxy.service

@@ -14,8 +14,8 @@ Environment=RUST_LOG=rust_proxy=info,warn
 Environment=MALLOC_ARENA_MAX=2
 Environment=PATH=/usr/local/bin:/usr/bin:/bin
 EnvironmentFile=-/etc/rustproxy/environment
-ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443 --allow-remote-admin
-ExecReload=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload
+ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443 --allow-remote-admin
+ExecReload=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 reload
 Restart=on-failure
 RestartSec=3
 KillSignal=SIGINT