Rayhaan JaufeerallyandClaude Fable 5.1
fd496d26bf
Preparing to run ferrix next to BIRD on the production router. - build: the config proto is now parsed in pure Rust, so building needs no `protoc` binary. It previously worked only where one happened to be installed; the Dockerfile in this repo could not have built. - peers gain `local_address`, the source IP for connections we open (and therefore the next hop we advertise). When both speakers share a host the OS would otherwise pick an arbitrary local address and the peer, which identifies us by address, would refuse the session. Address-family mismatches are rejected at config load; an address the host lacks shows up as the peer's backoff reason. - docs/lab/prod/on-router: static musl cross-build instructions, config, hardened systemd unit (unprivileged, SIGTERM gives BIRD a Cease), loopback addresses for networkd, the BIRD stanza for a same-host multihop session, and reverse-proxy examples with TLS and a password, since the API has no authentication. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
35 lines
862 B
Desktop File
35 lines
862 B
Desktop File
[Unit]
|
|
Description=ferrix_bgp teaching BGP speaker
|
|
After=network-online.target bird.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
ExecStart=/usr/local/bin/ferrix-bgp /etc/ferrix-bgp/ferrix.textpb --level info
|
|
# SIGTERM makes ferrix send Cease / Administrative Shutdown to BIRD first.
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=10
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# It needs the network and nothing else: no root, no privileged port, no
|
|
# write access anywhere.
|
|
DynamicUser=yes
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
CapabilityBoundingSet=
|
|
MemoryMax=256M
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|