35b7308ce2
Backend: - Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date) - NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle) - System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler) - Domain-Response-Headers + Rate-Limit (Migration 0024) - Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out - apt-Service für Update-Banner (apt-get update + Versionsprüfung) - Backup-Retry mit exponential backoff (retry_apt 3×) - publish.sh fail-fast + cleanup-old.sh (max 10 Versionen) Frontend: - Audit-Log-Page (/audit) mit Filter + Pagination - ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+) - Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix) - EmptyState-Komponente überall ausgerollt - SSL: Aggregate-Karte (total/expiring/expired/errors) - Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now - NTP: Sync-Status-Karte (chronyc tracking live) - Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats - Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN) - Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler) - Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention - Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint - System-Regeln im Firewall als eigener Tab Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
48 lines
1.9 KiB
Desktop File
48 lines
1.9 KiB
Desktop File
[Unit]
|
|
Description=EdgeGuard Management API
|
|
Documentation=https://git.netcell-it.de/projekte/edgeguard-native
|
|
After=network-online.target postgresql.service keydb-server.service
|
|
Wants=network-online.target keydb-server.service
|
|
Requires=postgresql.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=edgeguard
|
|
Group=edgeguard
|
|
ExecStart=/usr/bin/edgeguard-api
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Hardening — API needs to shell out to `sudo systemctl reload haproxy/squid`
|
|
# after writing configs. Sandboxing stays strict around fs/net.
|
|
NoNewPrivileges=false
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
SystemCallFilter=@system-service
|
|
# /var/lib/apt /var/cache/apt /etc/apt/apt.conf.d: damit `sudo -n apt-get
|
|
# update -qq` aus dem Update-Banner-Handler überhaupt in die Apt-Lists
|
|
# schreiben darf. Ohne diese Pfade läuft das Kommando still durch
|
|
# (exit 0) und der Cache bleibt veraltet — Banner zeigt nie ein Update.
|
|
# Befund 2026-05-14: trotz 30s-Poll blieb Candidate=Installed. mail-
|
|
# gateway hat dasselbe Set unter nmg-api.service.
|
|
#
|
|
# /var/backups/edgeguard: Backup-Service schreibt tar.gz Snapshots
|
|
# hierhin. Ohne Pfad in ReadWritePaths: read-only filesystem → EROFS.
|
|
# Befund 2026-05-15: "create eg-…tar.gz: read-only file system".
|
|
#
|
|
# /etc/chrony/conf.d /etc/unbound/unbound.conf.d /etc/wireguard:
|
|
# chrony/unbound/wg-Renderer schreiben edgeguard.conf bzw. <iface>.conf
|
|
# direkt in den distro-Conf-Dir (chrony+unbound) bzw. legen Symlinks
|
|
# nach /etc/edgeguard/wireguard (wg). Ohne diese Pfade scheitern alle
|
|
# UI-Mutationen an DNS/NTP/WireGuard-Settings still mit EROFS.
|
|
ReadWritePaths=/etc/edgeguard /var/lib/edgeguard /var/log/edgeguard /var/backups/edgeguard /var/lib/apt /var/cache/apt /etc/apt/apt.conf.d /etc/chrony/conf.d /etc/unbound/unbound.conf.d /etc/wireguard
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|