# datasource-proxy — Linux systemd unit (Option B in README.md)
#
# Isolates the *proxy*, for when the agent runs on the host and can't be
# sandboxed. A throwaway UID (DynamicUser) runs the binary; the secrets are
# handed to it via LoadCredential so the agent's UID can never read them.
#
# Install:
#   sudo install -Dm600 secrets.json    /etc/datasource-proxy/secrets.json   # root:root 0600
#   sudo install -Dm755 datasource-proxy /usr/local/bin/datasource-proxy
#   sudo cp deploy/datasource-proxy.service /etc/systemd/system/
#   sudo systemctl daemon-reload && sudo systemctl enable --now datasource-proxy
#
# Verify the wall holds (must be denied):
#   sudo -u <agent_user> cat /etc/datasource-proxy/secrets.json

[Unit]
Description=Datasource Proxy
After=network-online.target
Wants=network-online.target

[Service]
DynamicUser=yes
# root reads the file; only this service's ephemeral UID gets the contents
# (tmpfs, 0400, unreadable by anyone else).
LoadCredential=secrets:/etc/datasource-proxy/secrets.json
Environment=DS_PROXY_SECRETS=%d/secrets
ExecStart=/usr/local/bin/datasource-proxy --listen 127.0.0.1:8990
Restart=on-failure
RestartSec=2

# Hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6
CapabilityBoundingSet=
AmbientCapabilities=

[Install]
WantedBy=multi-user.target