bruno/ifcurl
1
0
Fork 0
mirror of https://github.com/brunopostle/ifcurl.git synced 2026-07-12 10:18:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
ifcurl/forgejo/server-config
History
Bruno Postle 6b6e47ef54 Split service into ifcurl-api + ifcurl-render for RCE isolation 
render_service.py: new FastAPI app with /render, /select, /render_diff
endpoints that wrap run_sandboxed — listens on a Unix domain socket.

service.py: imports the three pipeline functions from render_service.py;
delegates to render service via httpx when IFCURL_RENDER_SOCKET is set,
falls back to direct run_sandboxed when unset (single-service mode).

__main__.py: add 'render-service' subcommand (--socket PATH).

pyproject.toml: add httpx to service optional deps.

ifcurl-api.service: renamed from ifcurl-preview.service; sets
IFCURL_RENDER_SOCKET, adds AF_UNIX to RestrictAddressFamilies.

ifcurl-render.service: new hardened unit — AF_UNIX only, ~execve
~execveat blocked, no credentials, separate ifcurl-render user.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 10:00:33 +01:00
..
gitattributes gitconfig-ifcmerge: use --prioritise-local correctly per merge direction 2026-04-25 07:41:49 +01:00
gitconfig-ifcmerge gitconfig-ifcmerge: use --prioritise-local correctly per merge direction 2026-04-25 07:41:49 +01:00
ifcurl-api.service Split service into ifcurl-api + ifcurl-render for RCE isolation 2026-04-25 10:00:33 +01:00
ifcurl-preview.service ifcurl-preview.service: correct misleading execve comment 2026-04-25 08:30:41 +01:00
ifcurl-render.service Split service into ifcurl-api + ifcurl-render for RCE isolation 2026-04-25 10:00:33 +01:00