steve
02e4ef7544
Smoothes the rough edges that came up exercising a live deployment.
First-run bootstrap UI: /bootstrap renders a username + password form
that uses the in-memory token directly (operator no longer copies it
out of the log); /login redirects there while bootstrap is available.
Agent reliability: failJob synthetic envelopes so command.run early
returns no longer hang the server-side job; runtime probe of restic
restore --help drives --no-ownership instead of version sniffing
(0.18.x had it removed). Server unit re-shaped: ProtectSystem=full
plus ReadWritePaths=/etc/restic-manager, no ProtectHome — restore
can now write anywhere a user might want.
Restore wizard: default target is /root/rm-restore/<job-id>/ with
clearer help text. Re-init confirm input uses .field (was .input,
which doesn't exist — text was invisible).
NS-01 host delete: store DeleteHost, admin-band /hosts/{id}/delete
with hostname-confirm danger zone, audit, FK cascade, live WS close.
NS-02 enrollment-token recovery: outstanding-tokens panel on
/hosts/new, regenerate (preserves attachments) and revoke handlers
+ audit, store-level ListOutstandingEnrollmentTokens and
DeleteEnrollmentToken.
NS-03 repo init / probe surface: migration 0020 adds
hosts.repo_status + repo_status_error; WS handler projects every
init job's outcome onto the host row (idempotent already-initialised
collapses to ready); creds-save resets status and dispatches a fresh
probe; /hosts/{id}/repo/probe retry endpoint with banner.
NS-04 dashboard live + sort + filter: query-string filter
(q/status/repo_status/tag/sort/dir), 5s htmx live poll mirroring the
alerts pattern with a localStorage live toggle, sortable column
headers, filter row + clear.
Alerts page: ack'd-by line resolves user_id ULID to username.
Compose.yaml ignored — host-specific.
78 lines
3.3 KiB
Desktop File
78 lines
3.3 KiB
Desktop File
[Unit]
|
|
Description=restic-manager agent
|
|
Documentation=https://gitea.dcglab.co.uk/steve/restic-manager
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/local/bin/restic-manager-agent -config /etc/restic-manager/agent.yaml
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# The agent runs as root. A fleet-backup tool needs to read every
|
|
# file on the system regardless of DAC permissions; running as a
|
|
# dedicated unprivileged user means either silent skips on /home,
|
|
# /root, /var/lib/<other-daemons>, or operators having to add the
|
|
# service user to every group whose files they want backed up. Both
|
|
# are worse than the threat model already implies (the agent holds
|
|
# repo credentials, executes arbitrary restic, and runs operator-
|
|
# defined hooks — its blast radius is already large).
|
|
#
|
|
# The mitigation is aggressive systemd sandboxing of the root
|
|
# process: drop all capabilities except the few we need, deny
|
|
# writes outside our state dirs, and forbid privilege escalation.
|
|
User=root
|
|
Group=root
|
|
|
|
# CAP_DAC_READ_SEARCH lets us read any file regardless of DAC perms
|
|
# (the "backup everything" capability). CAP_DAC_OVERRIDE is needed
|
|
# during restore for chown/chmod to recreate ownership. Drop the
|
|
# rest — root in this process means "can read", not "can do".
|
|
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_CHOWN
|
|
AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_CHOWN
|
|
|
|
# Hardening — blocks privilege escalation even from root, and
|
|
# confines kernel / namespace / privilege surface. Filesystem reads
|
|
# stay open (that's the whole job) and restore writes are
|
|
# unrestricted: a backup tool whose entire purpose is "put files
|
|
# back where they belong" can't have ProtectHome=read-only or
|
|
# ProtectSystem=strict without breaking on the first cross-user
|
|
# restore. ProtectSystem=full keeps /usr, /boot, /efi read-only so a
|
|
# compromised agent can't swap out /usr/bin/restic or drop a kernel
|
|
# module, while leaving /home, /root, /var, /opt, /srv, /tmp etc.
|
|
# writable for arbitrary restore targets. The agent is treated as a
|
|
# high-trust component (it runs operator hooks as root and holds
|
|
# repo credentials); the residual hardening is about kernel + privesc
|
|
# protection, not write confinement.
|
|
NoNewPrivileges=true
|
|
ProtectSystem=full
|
|
# ProtectSystem=full mounts /usr, /boot, /efi *and* /etc read-only.
|
|
# The agent rewrites /etc/restic-manager/agent.yaml on enrolment and
|
|
# whenever a new SecretsKey is minted, so we need a targeted
|
|
# write-exemption for that dir. No exemption for the rest of /etc:
|
|
# the agent has no business editing /etc/passwd, /etc/sudoers, etc.
|
|
ReadWritePaths=/etc/restic-manager
|
|
ProtectHostname=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectControlGroups=true
|
|
ProtectClock=true
|
|
PrivateTmp=true
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
SystemCallArchitectures=native
|
|
# (No SystemCallFilter — the cap drop above already constrains what
|
|
# root can do; an allow-list filter killed restic with SIGSYS during
|
|
# init because @system-service excludes some of the syscalls Go's
|
|
# runtime + restic's file scanner reach for. The Protect*/Restrict*
|
|
# toggles still cover network / kernel / mount / namespace.)
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|