For reading and verification only. You may not copy, use, modify or redistribute this code. Full notice on the main page.
tunnel/deploy/all-tunnel.service
| 1 | # systemd unit for the ALL tunnel node (Ubuntu 24.04). `the deploy tool bootstrap` installs it with everything around it (the node runbook): |
| 2 | # |
| 3 | # /opt/all-tunnel/releases/<id>/all-tunnel one directory per release, named by the first 16 hex characters of the binary's SHA-256 |
| 4 | # /opt/all-tunnel/current -> releases/<id> what runs; /opt/all-tunnel/previous is what a rollback flips back to |
| 5 | # /usr/local/bin/all-tunnel -> /opt/all-tunnel/current/all-tunnel |
| 6 | # /etc/all-tunnel/env TUNNEL_NODE_ID, TUNNEL_NODE_KID, TUNNEL_NODE_HOST and the certificate paths (0600) |
| 7 | # /etc/all-tunnel/node.key the node's one secret, made ON the node (`all-tunnel -node-key-init`); only its public half is ever printed |
| 8 | # |
| 9 | # Two listeners and no other: :443 (devices' control and data connections on the node's own name, clients of devices on every other name) and :80 (the |
| 10 | # node's own ACME webroot, nothing else). The node holds no secret of devices: it verifies their sessions against the control plane's published keys |
| 11 | # and asks the control plane what each may do, signing every request with its own Ed25519 key, the only secret it has: systemd hands it over as a |
| 12 | # credential (LoadCredential below), so the service's dynamic user reads it and nobody else does. The control plane's address defaults to the one the |
| 13 | # policy pins (TUNNEL_CONTROL_URL changes it for a staging node). |
| 14 | # |
| 15 | # /metrics and /healthz listen on 127.0.0.1:9101 (TUNNEL_METRICS_ADDR changes the port, and refuses an address that is not loopback): aggregate |
| 16 | # counters only, nothing per device, nothing with an address or a name in it. The kernel side of the limits is nftables.conf and sysctl.conf next to |
| 17 | # this file; the node does not load them (it has no privilege to). Nothing the node writes to the journal names an address or a SNI, and |
| 18 | # journald-volatile.conf keeps the journal in memory anyway: nothing of a node survives a reboot but its key and its certificate. |
| 19 | # |
| 20 | # systemctl stop / restart sends SIGTERM, which DRAINS: no new clients, the open streams finish, and the node leaves when they are gone or after the |
| 21 | # quiet period (TUNNEL_DRAIN_QUIET, 20 minutes by default, policy timing.drain_quiet_s), so TimeoutStopSec must be longer than that |
| 22 | # (the deploy tests hold the two together). systemctl reload re-reads the node's certificate (SIGHUP). Deploy one node at a time, after |
| 23 | # taking its address out of the DNS (the design plan, section 5, the node runbook). |
| 24 | [Unit] |
| 25 | Description=ALL tunnel node (SNI router, never decrypts) |
| 26 | After=network-online.target |
| 27 | Wants=network-online.target |
| 28 | |
| 29 | [Service] |
| 30 | EnvironmentFile=/etc/all-tunnel/env |
| 31 | Environment=TUNNEL_NODE_KEY_FILE=%d/node-key |
| 32 | Environment=TUNNEL_OPENAI_PREFIXES_CACHE=%S/all-tunnel/openai-prefixes.json |
| 33 | LoadCredential=node-key:/etc/all-tunnel/node.key |
| 34 | ExecStart=/usr/local/bin/all-tunnel |
| 35 | ExecReload=/bin/kill -HUP $MAINPID |
| 36 | Restart=always |
| 37 | RestartSec=2 |
| 38 | DynamicUser=yes |
| 39 | StateDirectory=all-tunnel |
| 40 | AmbientCapabilities=CAP_NET_BIND_SERVICE |
| 41 | CapabilityBoundingSet=CAP_NET_BIND_SERVICE |
| 42 | NoNewPrivileges=yes |
| 43 | ProtectSystem=strict |
| 44 | ProtectHome=yes |
| 45 | PrivateTmp=yes |
| 46 | PrivateDevices=yes |
| 47 | ProtectKernelTunables=yes |
| 48 | ProtectKernelModules=yes |
| 49 | ProtectKernelLogs=yes |
| 50 | ProtectControlGroups=yes |
| 51 | ProtectClock=yes |
| 52 | ProtectHostname=yes |
| 53 | ProtectProc=invisible |
| 54 | # no ProcSubset=pid: it hides /proc/sys, and Go reads /proc/sys/net/core/somaxconn for its listen backlog (sysctl.conf raises it to 4096 for the reconnection |
| 55 | # storm); without the file the node falls back to 128 |
| 56 | LockPersonality=yes |
| 57 | RestrictNamespaces=yes |
| 58 | RestrictRealtime=yes |
| 59 | RestrictSUIDSGID=yes |
| 60 | RestrictAddressFamilies=AF_INET AF_INET6 |
| 61 | SystemCallArchitectures=native |
| 62 | UMask=0077 |
| 63 | LimitNOFILE=65536 |
| 64 | TimeoutStopSec=1500 |
| 65 | |
| 66 | [Install] |
| 67 | WantedBy=multi-user.target |