Claus Lohmar
f58d33aee1
Document the D-043 deployment: the browser -> Zoraxy (10.1.0.10, TLS) -> app (0.0.0.0:8080, http) topology, the config.yaml, the Zoraxy ProxyHost headers (X-Forwarded-For + X-Forwarded-Proto), the firewall rule, the tunnel-only bootstrap, systemd, and the misconfig warnings. - config.example.yaml: trusted_proxies: ["10.1.0.10"] with the silent-failure and firewall caveats. - deploy/myday.service: the systemd unit (Type=simple, Restart=on-failure, User/WorkingDirectory/ExecStart, After=network-online.target). - docs/deploy-zoraxy.md: the full walkthrough. - README.md: the Deployment section points at the guide. Docs/deploy only — no code change.
41 lines
1.5 KiB
Desktop File
41 lines
1.5 KiB
Desktop File
# MyDay — systemd unit (D-043: the app runs behind Zoraxy; TLS terminates there).
|
|
#
|
|
# INSTALL (as root):
|
|
# 1. build the static, CGO-free binary:
|
|
# go build -trimpath -o /usr/local/bin/myday ./cmd/myday
|
|
# 2. create the app dir (config.yaml + data/ live there) and drop in the config:
|
|
# install -d -o <myday-user> -g <myday-group> <app-dir>
|
|
# install -m 0640 -o <myday-user> -g <myday-group> config.yaml <app-dir>/config.yaml
|
|
# 3. systemctl daemon-reload && systemctl enable --now myday
|
|
#
|
|
# Replace every <PLACEHOLDER> below (path placeholders must resolve to ABSOLUTE
|
|
# paths). `config.yaml` is gitignored — NEVER commit it (D-010). See
|
|
# docs/deploy-zoraxy.md for the full deployment walkthrough.
|
|
|
|
[Unit]
|
|
Description=MyDay — Sechpoint employee app
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=<myday-user>
|
|
Group=<myday-group>
|
|
WorkingDirectory=<app-dir>
|
|
# binary path, e.g. /usr/local/bin/myday (no inline comments — systemd keeps them)
|
|
ExecStart=<binary>
|
|
Environment=MYDAY_CONFIG=<app-dir>/config.yaml
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
|
|
# The binary is static and CGO-free; at runtime the app writes only config.yaml,
|
|
# data/ and the SQLite files inside WorkingDirectory (the wizard persists the
|
|
# generated secrets there). ReadWritePaths keeps `ProtectSystem=strict` from
|
|
# breaking those writes.
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ReadWritePaths=<app-dir>
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|