makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add Phase 2B contained runtime artifacts

Browse source
This commit is contained in:
makearmy 2026-07-12 21:01:17 -04:00
parent a9fec0d83d
commit 82e64cec43
35 changed files with 5177 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/le-app-codex-runtime/resolv.conf Normal file
View file

@ -0,0 +1,4 @@
# Phase 2B IPv4-only public DNS; no LAN resolver exception.
nameserver 9.9.9.9
nameserver 149.112.112.112
options edns0 trust-ad

54
docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/nftables.d/50-le-app-codex.nft Normal file
View file

@ -0,0 +1,54 @@
table inet le_app_codex {
set approved_dns4 {
type ipv4_addr
flags interval
elements = { 9.9.9.9, 149.112.112.112 }
}
set operator_host_public4 {
type ipv4_addr
flags interval
elements = { 74.67.173.56 }
}
set denied4 {
type ipv4_addr
flags interval
elements = {
0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24,
192.0.2.0/24, 192.88.99.0/24, 192.168.0.0/16,
198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24,
224.0.0.0/4, 240.0.0.0/4
}
}
chain input {
type filter hook input priority filter; policy accept;
iifname "lecodex-host" ct state established,related accept
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
iifname "lecodex-host" counter drop
}
chain forward {
type filter hook forward priority filter; policy accept;
oifname "lecodex-host" ct state established,related accept
oifname "lecodex-host" counter drop
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
iifname "lecodex-host" ip daddr @operator_host_public4 counter drop
iifname "lecodex-host" ip daddr @denied4 counter drop
iifname "lecodex-host" meta nfproto ipv6 counter drop
iifname "lecodex-host" tcp dport { 25, 465, 587 } counter drop
iifname "lecodex-host" tcp dport { 80, 443 } accept
iifname "lecodex-host" counter drop
}
}
table ip le_app_codex_nat {
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ip saddr 10.200.120.0/30 oifname != "lecodex-host" masquerade
}
}

11
docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/systemd/system/le-app-codex-netns.service Normal file
View file

@ -0,0 +1,11 @@
[Unit]
Description=Root-owned IPv4-only namespace for le_app_codex
Before=user@1200.service
ConditionPathExists=/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/libexec/le-app-codex-netns up
ExecStop=/usr/local/libexec/le-app-codex-netns down

7
docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf Normal file
View file

@ -0,0 +1,7 @@
[Slice]
CPUQuota=600%
MemoryHigh=48G
MemoryMax=64G
MemorySwapMax=16G
TasksMax=4096

40
docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf Normal file
View file

@ -0,0 +1,40 @@
[Unit]
Requires=le-app-codex-netns.service
After=le-app-codex-netns.service
[Service]
NetworkNamespacePath=/run/netns/le-app-codex
ProtectSystem=strict
PrivateTmp=yes
ProtectHome=yes
ProtectProc=invisible
ProcSubset=all
BindReadOnlyPaths=/etc/le-app-codex-runtime/resolv.conf:/etc/resolv.conf
TemporaryFileSystem=/srv:ro
BindPaths=/srv/le-app-codex:/srv/le-app-codex
TemporaryFileSystem=/var:ro
TemporaryFileSystem=/mnt:ro
TemporaryFileSystem=/media:ro
TemporaryFileSystem=/opt:ro
InaccessiblePaths=/var/www
InaccessiblePaths=/root
InaccessiblePaths=/home
InaccessiblePaths=/boot
InaccessiblePaths=/efi
InaccessiblePaths=/run/docker.sock
InaccessiblePaths=/var/run/docker.sock
InaccessiblePaths=/run/containerd/containerd.sock
InaccessiblePaths=/run/podman
InaccessiblePaths=/run/dbus/system_bus_socket
InaccessiblePaths=/run/systemd/private
InaccessiblePaths=/var/lib/docker
InaccessiblePaths=/var/lib/containerd
InaccessiblePaths=/var/lib/containers
InaccessiblePaths=/etc/docker
InaccessiblePaths=/etc/containers
InaccessiblePaths=/etc/ssh
InaccessiblePaths=/etc/NetworkManager/system-connections
InaccessiblePaths=/etc/wireguard
DevicePolicy=closed
DeviceAllow=/dev/fuse rw
DeviceAllow=/dev/net/tun rw