Initial vibeproxy implementation

Self-contained HTTP/HTTPS/TCP/UDP reverse proxy manager written in Go, with SQLite storage, a Bootstrap 5 admin UI (Go templates, no JS framework), and a REST API under /api/v1. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QTXFrNP1imCW7jtfL5SZrw
2026-08-17 10:28:59 -05:00
commit ba1f7c4c03
105 changed files with 9142 additions and 0 deletions
@@ -0,0 +1,42 @@
+[Unit]
+Description=vibeproxy - self-contained reverse proxy manager
+After=network-online.target
+Wants=network-online.target
+Documentation=https://github.com/owen/vibeproxy
+
+[Service]
+Type=simple
+User=vibeproxy
+Group=vibeproxy
+ExecStart=/usr/local/bin/vibeproxy serve --data-dir=/var/lib/vibeproxy --db-path=/var/lib/vibeproxy/vibeproxy.db --http-addr=:80 --https-addr=:443 --admin-addr=127.0.0.1:8081
+Restart=on-failure
+RestartSec=2s
+TimeoutStopSec=30s
+
+# vibeproxy needs to bind ports 80/443; grant that capability instead of
+# running as root.
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+
+# Filesystem/process hardening.
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+ReadWritePaths=/var/lib/vibeproxy
+
+# vibeproxy stores its SQLite database, TLS private keys, and backups
+# here; keep it 0700 and owned by the service user (see README).
+StateDirectory=vibeproxy
+StateDirectoryMode=0700
+
+LimitNOFILE=65535
+
+[Install]
+WantedBy=multi-user.target