paivana

HTTP paywall reverse proxy
Log | Files | Refs | Submodules | README | LICENSE

paivana-httpd.service (3897B)


      1 [Unit]
      2 StartLimitIntervalSec=0
      3 Description=Paivana Taler paywall reverse proxy
      4 After=network.target
      5 Requires=paivana-httpd.socket
      6 
      7 # Startup is deliberately fail-closed: paivana-httpd refuses to serve
      8 # anything until it has loaded every paywall template from the merchant
      9 # backend, because a template it could not load is a set of URLs it
     10 # would hand out for free.  A backend that is merely restarting must
     11 # therefore be ridden out by restarting us, using the fixed retry
     12 # delay below -- so the start rate limiter must NOT be allowed to give
     13 # up and leave the unit failed.  A configuration error is the opposite
     14 # case and is handled by RestartPreventExitStatus.
     15 
     16 [Service]
     17 # DD102: retry transient failures without a start-rate limit.
     18 Restart=always
     19 RestartSec=10s
     20 User=paivana-httpd
     21 Type=simple
     22 RestartMode=direct
     23 
     24 # 9 is EXIT_NO_RESTART, 6 is EXIT_NOTCONFIGURED (src/include/platform.h).
     25 # Neither is transient: retrying a missing DESTINATION_BASE_URL or an
     26 # unparseable TRUSTED_PROXIES only fills the journal.
     27 RestartPreventExitStatus=6 9
     28 
     29 # RuntimeMaxSec is incompatible with DD102 socket lifetime on systemd 257:
     30 # reaching the limit stops the bound socket and cancels automatic recovery.
     31 
     32 # Paivana's current GNUnet/Taler event loop uses select(), whose fd_set has
     33 # 1024 entries on this platform.  Raising this value would let libraries open
     34 # descriptors Paivana cannot poll.  The default CONNECTION_LIMIT=384 budgets
     35 # two descriptors per request and leaves the remaining 256 for listeners,
     36 # scheduler/library state, resolver activity and transient overlap.
     37 LimitNOFILE=1024
     38 
     39 # SHUTDOWN_GRACE_PERIOD defaults to 60 s.  The extra 15 s lets Paivana cancel
     40 # remaining curl work, stop MHD and release templates before systemd sends
     41 # SIGKILL; keep this value above the configured application grace period.
     42 TimeoutStopSec=75s
     43 # -f: we are served over a Unix socket by nginx/Apache (see the
     44 # shipped site configs), so the client address has to come from the
     45 # forwarding headers -- a Unix peer has no address of its own, and
     46 # without this every visitor would be indistinguishable.  It is only
     47 # safe because those configs overwrite the headers rather than
     48 # appending to a client-supplied value; do not enable it for a
     49 # paivana-httpd that is reachable directly.
     50 ExecStart=/usr/bin/paivana-httpd -c /etc/paivana/paivana.conf -f -L INFO
     51 
     52 StandardOutput=journal
     53 StandardError=journal
     54 
     55 # libgnunetcurl records every completed outbound request at INFO.  That is
     56 # useful while debugging, but turns the production journal into an access log
     57 # for every request Paivana proxies.  Keep INFO for Paivana's lifecycle and
     58 # recovery messages while limiting that library source file to actionable
     59 # severities.  The merchant client also emits one generic warning for every
     60 # failed order poll; Paivana's sampled warning has timing, concurrency and fd
     61 # context, so suppress the duplicate library warning in production.  The final
     62 # rule deliberately restores INFO for every other source file.
     63 Environment="GNUNET_FORCE_LOG=;curl.c;;;WARNING/;merchant_api_get-private-orders-ORDER_ID.c;;;ERROR/;;;;INFO"
     64 
     65 # Hardening.  paivana-httpd needs a listening socket handed to it,
     66 # outbound TCP to the merchant backend and the origin, and read access
     67 # to its own configuration -- nothing else.  DynamicUser is deliberately
     68 # NOT used: paivana-httpd.socket names SocketUser=paivana-httpd, which
     69 # needs a stable account.
     70 PrivateTmp=yes
     71 PrivateDevices=yes
     72 ProtectSystem=strict
     73 ProtectHome=yes
     74 ProtectKernelTunables=yes
     75 ProtectKernelModules=yes
     76 ProtectControlGroups=yes
     77 NoNewPrivileges=yes
     78 RestrictSUIDSGID=yes
     79 RestrictNamespaces=yes
     80 LockPersonality=yes
     81 MemoryDenyWriteExecute=yes
     82 RestrictRealtime=yes
     83 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
     84 CapabilityBoundingSet=
     85 SystemCallArchitectures=native
     86 SystemCallFilter=@system-service
     87 SystemCallErrorNumber=EPERM
     88 
     89 [Install]
     90 WantedBy=multi-user.target