Add NETfishing discovery service

deploy/netfishing-discovery.env.example

@@ -0,0 +1,12 @@
+# Bind locally and place a TLS reverse proxy in front of the service.
+NETFISHING_DISCOVERY_HOST=127.0.0.1
+NETFISHING_DISCOVERY_PORT=7770
+NETFISHING_DISCOVERY_ROOM_TTL=45
+NETFISHING_DISCOVERY_MAX_ROOMS=4096
+NETFISHING_DISCOVERY_MAX_ROOMS_PER_ADDRESS=32
+NETFISHING_DISCOVERY_MAX_BODY_BYTES=8192
+NETFISHING_DISCOVERY_LOG_LEVEL=INFO
+
+# Only trust X-Forwarded-For when the immediate peer is within one of these CIDRs.
+# The loopback values suit a reverse proxy on the same host.
+NETFISHING_DISCOVERY_TRUSTED_PROXY_CIDRS=127.0.0.0/8,::1/128

deploy/netfishing-discovery.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=NETfishing public room discovery service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=netfishing-discovery
+Group=netfishing-discovery
+WorkingDirectory=/var/www/netfishing.org.discovery
+EnvironmentFile=/etc/netfishing-discovery.env
+ExecStart=/usr/bin/python3 -m netfishing_discovery
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+
+[Install]
+WantedBy=multi-user.target