mirror of
https://github.com/brunopostle/ifcurl.git
synced 2026-07-12 10:18:14 +00:00
Bruno Postle
6b6e47ef54
render_service.py: new FastAPI app with /render, /select, /render_diff endpoints that wrap run_sandboxed — listens on a Unix domain socket. service.py: imports the three pipeline functions from render_service.py; delegates to render service via httpx when IFCURL_RENDER_SOCKET is set, falls back to direct run_sandboxed when unset (single-service mode). __main__.py: add 'render-service' subcommand (--socket PATH). pyproject.toml: add httpx to service optional deps. ifcurl-api.service: renamed from ifcurl-preview.service; sets IFCURL_RENDER_SOCKET, adds AF_UNIX to RestrictAddressFamilies. ifcurl-render.service: new hardened unit — AF_UNIX only, ~execve ~execveat blocked, no credentials, separate ifcurl-render user. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
54 lines
1.8 KiB
Desktop File
54 lines
1.8 KiB
Desktop File
[Unit]
|
|
Description=ifcurl API service (git fetch + caching + SSRF protection)
|
|
Documentation=https://github.com/brunopostle/ifcurl
|
|
After=network.target ifcurl-render.service
|
|
Requires=ifcurl-render.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=ifcurl
|
|
Group=ifcurl
|
|
EnvironmentFile=-/etc/ifcurl/env
|
|
# Tell the API service where to find the render service Unix socket
|
|
Environment=IFCURL_RENDER_SOCKET=/run/ifcurl/render.sock
|
|
ExecStart=/usr/local/bin/ifcurl serve \
|
|
--host 127.0.0.1 \
|
|
--port 8000 \
|
|
--allowed-hosts git.example.com
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Cache configuration — override in /etc/ifcurl/env:
|
|
# IFCURL_CACHE_MAX_GB=10 max bare-repo disk cache
|
|
# IFCURL_T2_MAX=8 max IFC blobs in memory
|
|
# IFCURL_T3_MAX=64 max selector results in memory
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Sandbox hardening
|
|
#
|
|
# The API service fetches from git remotes and reads tokens from
|
|
# /etc/ifcurl/env — it needs network access and execve for git CLI calls.
|
|
# IFC parsing and rendering are delegated to ifcurl-render.service over
|
|
# a Unix socket, so this service never loads ifcopenshell or pyvista.
|
|
# ---------------------------------------------------------------------------
|
|
Environment=XDG_CACHE_HOME=/var/cache
|
|
CacheDirectory=ifcurl
|
|
NoNewPrivileges=yes
|
|
RestrictSUIDSGID=yes
|
|
PrivateTmp=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ReadWritePaths=/var/cache/ifcurl /run/ifcurl
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictNamespaces=yes
|
|
LockPersonality=yes
|
|
RestrictRealtime=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service @process @files @io-event @network-io
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|