ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
15 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

32
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-admission.service Normal file
View file

@ -0,0 +1,32 @@
[Unit]
Description=Update OCI L4 relay address admission
Wants=network-online.target
After=network-online.target nftables.service oci-l4-relay-bootstrap.service
ConditionPathExists=/etc/oci-l4-relay/config.json
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/oci-l4-relay-guest admission refresh
LogNamespace=oci-l4-relay
CapabilityBoundingSet=CAP_NET_ADMIN
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
ReadWritePaths=/var/lib/oci-l4-relay/web-allow
RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077

11
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-admission.timer Normal file
View file

@ -0,0 +1,11 @@
[Unit]
Description=Periodically update OCI L4 relay address admission
[Timer]
OnBootSec=6h
OnUnitActiveSec=6h
RandomizedDelaySec=15m
Persistent=true
[Install]
WantedBy=timers.target

37
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-bootstrap.service Normal file
View file

@ -0,0 +1,37 @@
[Unit]
Description=Bootstrap OCI L4 relay
Wants=network-online.target
After=network-online.target nftables.service
ConditionPathExists=/etc/oci-l4-relay/config.json
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/oci-l4-relay-guest bootstrap
RemainAfterExit=true
LogNamespace=oci-l4-relay
CapabilityBoundingSet=CAP_NET_ADMIN
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectSystem=strict
ReadWritePaths=/etc/oci-l4-relay /etc/sysconfig /etc/sysctl.d /var/lib/oci-l4-relay
RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
Restart=on-failure
RestartSec=15
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077
[Install]
WantedBy=multi-user.target

46
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-journal-upload.service Normal file
View file

@ -0,0 +1,46 @@
[Unit]
Description=Upload OCI L4 relay journal namespace to vlagent
Requires=oci-l4-relay-vlagent.service
After=oci-l4-relay-vlagent.service [email protected]
ConditionPathExists=/etc/oci-l4-relay/log-ingest.token
PartOf=oci-l4-relay-logs.target
[Service]
Type=simple
DynamicUser=yes
User=systemd-journal-upload
SupplementaryGroups=systemd-journal
StateDirectory=systemd/journal-upload
ExecStart=/usr/lib/systemd/systemd-journal-upload --namespace=oci-l4-relay --url=http://127.0.0.1:19532/insert/journald --save-state --system --follow
Restart=on-failure
RestartSec=10s
RestartSteps=10
RestartMaxDelaySec=60
Slice=oci-l4-relay-logs.slice
WatchdogSec=3min
CapabilityBoundingSet=
IPAddressDeny=any
IPAddressAllow=localhost
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/var/lib/systemd/journal-upload
RestrictAddressFamilies=AF_UNIX AF_INET
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077
LimitNOFILE=524288

35
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-log-credential.service Normal file
View file

@ -0,0 +1,35 @@
[Unit]
Description=Update OCI L4 relay log ingestion credential
Wants=network-online.target
After=network-online.target oci-l4-relay-bootstrap.service
ConditionPathExists=/etc/oci-l4-relay/config.json
StartLimitIntervalSec=10m
StartLimitBurst=20
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/oci-l4-relay-guest logs update
LogNamespace=oci-l4-relay
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
ReadWritePaths=/etc/oci-l4-relay
Restart=on-failure
RestartSec=30s
RestrictAddressFamilies=AF_UNIX AF_INET
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077

11
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-log-credential.timer Normal file
View file

@ -0,0 +1,11 @@
[Unit]
Description=Periodically update OCI L4 relay log ingestion credential
[Timer]
OnBootSec=1m
OnUnitActiveSec=1h
RandomizedDelaySec=30s
Persistent=true
[Install]
WantedBy=timers.target

9
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-logs.path Normal file
View file

@ -0,0 +1,9 @@
[Unit]
Description=Start OCI L4 relay log ingestion after credential delivery
[Path]
PathExists=/etc/oci-l4-relay/log-ingest.token
Unit=oci-l4-relay-logs.target
[Install]
WantedBy=multi-user.target

7
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-logs.slice Normal file
View file

@ -0,0 +1,7 @@
[Unit]
Description=OCI L4 relay log ingestion resource boundary
[Slice]
MemoryAccounting=yes
MemoryHigh=128M
MemoryMax=256M

4
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-logs.target Normal file
View file

@ -0,0 +1,4 @@
[Unit]
Description=OCI L4 relay log ingestion
Wants=oci-l4-relay-vlagent.service oci-l4-relay-journal-upload.service
After=oci-l4-relay-bootstrap.service

32
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-smtp-deny.service Normal file
View file

@ -0,0 +1,32 @@
[Unit]
Description=Update OCI L4 relay SMTP deny policy
Wants=network-online.target
After=network-online.target nftables.service oci-l4-relay-bootstrap.service
ConditionPathExists=/etc/oci-l4-relay/config.json
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/oci-l4-relay-guest smtp-deny refresh
LogNamespace=oci-l4-relay
CapabilityBoundingSet=CAP_NET_ADMIN
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
ReadWritePaths=/var/lib/oci-l4-relay/smtp-deny
RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077

11
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-smtp-deny.timer Normal file
View file

@ -0,0 +1,11 @@
[Unit]
Description=Periodically update OCI L4 relay SMTP deny policy
[Timer]
OnBootSec=1m
OnUnitActiveSec=5m
RandomizedDelaySec=30s
Persistent=true
[Install]
WantedBy=timers.target

41
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-smtp-evidence.service Normal file
View file

@ -0,0 +1,41 @@
[Unit]
Description=Collect OCI L4 relay transport evidence and metrics
Wants=oci-l4-relay-telemetry.service
After=nftables.service oci-l4-relay-bootstrap.service oci-l4-relay-telemetry.service
ConditionPathExists=/etc/oci-l4-relay-smtp-evidence.json
[Service]
Type=simple
DynamicUser=yes
StateDirectory=oci-l4-relay/smtp-evidence
ExecStart=/usr/local/libexec/oci-l4-relay-smtp-evidence
Restart=on-failure
RestartSec=10s
LogNamespace=oci-l4-relay
AmbientCapabilities=CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_ADMIN
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadOnlyPaths=/etc/oci-l4-relay-smtp-evidence.json
RestrictAddressFamilies=AF_INET AF_UNIX AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077
[Install]
WantedBy=multi-user.target

34
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-telemetry.service Normal file
View file

@ -0,0 +1,34 @@
[Unit]
Description=Report sanitized OCI L4 relay telemetry
After=nftables.service oci-l4-relay-bootstrap.service
ConditionPathExists=/etc/oci-l4-relay/config.json
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/oci-l4-relay-guest telemetry
LogNamespace=oci-l4-relay
RuntimeDirectory=oci-l4-relay-telemetry
RuntimeDirectoryMode=0755
RuntimeDirectoryPreserve=yes
CapabilityBoundingSet=CAP_NET_ADMIN
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
StandardError=journal+console
StandardOutput=journal+console
SystemCallArchitectures=native
SystemCallFilter=@system-service

10
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-telemetry.timer Normal file
View file

@ -0,0 +1,10 @@
[Unit]
Description=Periodically report sanitized OCI L4 relay telemetry
[Timer]
OnBootSec=2m
OnUnitActiveSec=1m
AccuracySec=10s
[Install]
WantedBy=timers.target

42
services/oci-l4-relay-guest/image/systemd/oci-l4-relay-vlagent.service Normal file
View file

@ -0,0 +1,42 @@
[Unit]
Description=Buffer OCI L4 relay journals for VictoriaLogs
Wants=network-online.target
After=network-online.target oci-l4-relay-bootstrap.service
ConditionPathExists=/etc/oci-l4-relay/log-ingest.token
PartOf=oci-l4-relay-logs.target
[Service]
Type=simple
User=oci-l4-relay-logs
Group=oci-l4-relay-logs
StateDirectory=oci-l4-relay-logs
ExecStart=/usr/local/bin/vlagent -httpListenAddr=127.0.0.1:19532 -journald.ignoreFields=__CURSOR,__MONOTONIC_TIMESTAMP,__SEQNUM,__SEQNUM_ID,_AUDIT_LOGINUID,_AUDIT_SESSION,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_MACHINE_ID,_PID,_RUNTIME_SCOPE,_SELINUX_CONTEXT,_SOURCE_REALTIME_TIMESTAMP,_SYSTEMD_CGROUP,_SYSTEMD_INVOCATION_ID,_SYSTEMD_SLICE,_SYSTEMD_USER_SLICE,_SYSTEMD_USER_UNIT,_TRANSPORT,_UID -journald.streamFields=_SYSTEMD_UNIT,_HOSTNAME -memory.allowedBytes=67108864 -remoteWrite.bearerTokenFile=/etc/oci-l4-relay/log-ingest.token -remoteWrite.maxDiskUsagePerURL=536870912 -remoteWrite.rateLimit=1048576 -remoteWrite.tmpDataPath=/var/lib/oci-l4-relay-logs -remoteWrite.url=https://relay-logs.quorate.dev/insert/native
Restart=on-failure
RestartSec=10s
Slice=oci-l4-relay-logs.slice
CapabilityBoundingSet=
IPAddressDeny=any
IPAddressAllow=localhost
IPAddressAllow=10.104.40.127
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
ReadOnlyPaths=/etc/oci-l4-relay/log-ingest.token
ReadWritePaths=/var/lib/oci-l4-relay-logs
RestrictAddressFamilies=AF_UNIX AF_INET
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077