Rayhaan JaufeerallyandClaude Opus 5.5
dc275f99d7
The documentation moves from READMEs into a site in docs/: getting started, a user guide, operations, a reference, and development pages, written in the style of network vendors' documentation (docs/STYLE.md). bin/bgp/README.md and docs/RFCs.md are folded into it. - A theme of its own in the International Typographic Style, in blues, with self-hosted Inter and JetBrains Mono, search over Zola's index, dark mode, and no resources loaded from other hosts. - Example configurations in docs/examples/, shown on the pages and checked with `bgp --check` in CI. - A test that fails when a field of config.proto is missing from the configuration reference. - A CI job that builds the site; Zola fails on broken links and anchors. - A hardened systemd unit, tried under systemd with kernel routes on. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
53 lines
1.5 KiB
Desktop File
53 lines
1.5 KiB
Desktop File
# /etc/systemd/system/ferrix.service
|
|
#
|
|
# Runs the Ferrix daemon as an unprivileged user, with only the
|
|
# capabilities that it requires, and restricts its access to the system.
|
|
# The log is written to the journal: journalctl -u ferrix.
|
|
[Unit]
|
|
Description=Ferrix BGP daemon
|
|
Documentation=https://ferrix.rayhaan.net/docs/
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
User=ferrix
|
|
Group=ferrix
|
|
# Validate the configuration before starting. An invalid configuration
|
|
# prevents the start, and the error is written to the journal.
|
|
ExecStartPre=/usr/local/bin/bgp --check /etc/ferrix/server.textpb
|
|
ExecStart=/usr/local/bin/bgp /etc/ferrix/server.textpb --level info
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
# Time to notify all neighbors and remove the kernel routes.
|
|
TimeoutStopSec=30s
|
|
|
|
# TCP port 179, and the kernel routing table.
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
|
|
NoNewPrivileges=yes
|
|
|
|
# BGP, RTR, HTTP, and netlink sockets only.
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|