owenandClaude Sonnet 5
ba1f7c4c03
Self-contained HTTP/HTTPS/TCP/UDP reverse proxy manager written in Go, with SQLite storage, a Bootstrap 5 admin UI (Go templates, no JS framework), and a REST API under /api/v1. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QTXFrNP1imCW7jtfL5SZrw
43 lines
1.1 KiB
Desktop File
43 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=vibeproxy - self-contained reverse proxy manager
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
Documentation=https://github.com/owen/vibeproxy
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=vibeproxy
|
|
Group=vibeproxy
|
|
ExecStart=/usr/local/bin/vibeproxy serve --data-dir=/var/lib/vibeproxy --db-path=/var/lib/vibeproxy/vibeproxy.db --http-addr=:80 --https-addr=:443 --admin-addr=127.0.0.1:8081
|
|
Restart=on-failure
|
|
RestartSec=2s
|
|
TimeoutStopSec=30s
|
|
|
|
# vibeproxy needs to bind ports 80/443; grant that capability instead of
|
|
# running as root.
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
NoNewPrivileges=true
|
|
|
|
# Filesystem/process hardening.
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
ReadWritePaths=/var/lib/vibeproxy
|
|
|
|
# vibeproxy stores its SQLite database, TLS private keys, and backups
|
|
# here; keep it 0700 and owned by the service user (see README).
|
|
StateDirectory=vibeproxy
|
|
StateDirectoryMode=0700
|
|
|
|
LimitNOFILE=65535
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|