Frank
d2810ab610
Closing the command-center security queue #70/#71/#72/#73/#74: rolling tags let a rebuild move under a running service with nobody approving it, and make a CVE audit ungradeable. 36 quadlet units across dankclaw, dankserver and frankbook-pro now carry tag@sha256; localhost/* builds stay exempt (their build is the pin). The pihole and copyparty pins pull the fixed builds; valkey 9.1.2 (already running) and redis 7.4.11 are pinned in place, vendor fixes TBD. New gate tests/quadlet_image_pins.bats: no unpinned registry image, no generator-rejected key anywhere. Three seams that pinned the old exact-tag law (frankbook readarr, open_webui, seerr) now require tag AND digest - strictly stronger. Quadlet Lifecycle docs: batch-abort law, entrypoint flags-only law, pin law.
50 lines
2.1 KiB
INI
50 lines
2.1 KiB
INI
# Quadlet unit: Gluetun VPN tunnel in FrankBook-Pro's podman machine.
|
|
#
|
|
# Install path is INSIDE the machine VM:
|
|
# /home/core/.config/containers/systemd/gluetun.container
|
|
# (installed by the frankbook-pro handler in scripts/deploy-remote.sh —
|
|
# install_quadlet targets the Linux hosts' systemctl --user, not the VM).
|
|
#
|
|
# WireGuard tunnel to ProtonVPN. qBittorrent and all five *arrs share this
|
|
# container's network namespace (Network=gluetun.container) so every fleet
|
|
# container's egress — torrent traffic, indexer APIs, metadata lookups —
|
|
# exits ONLY through the tunnel (AllowedIPs=0.0.0.0/0). Every fleet port
|
|
# publishes HERE; a netns-sharer publishes no ports of its own (same
|
|
# invariant as the dankclaw searxng/gluetun pair). Credentials live in
|
|
# /home/core/Containers/gluetun/env inside the VM (mode 0600, never
|
|
# committed); the private key is Mac-tunnel-specific and MUST NOT be copied
|
|
# from dankclaw — one WireGuard peer key cannot serve two machines at once.
|
|
[Unit]
|
|
Description=Gluetun VPN tunnel (FrankBook-Pro podman machine)
|
|
|
|
[Container]
|
|
ContainerName=gluetun
|
|
Image=docker.io/qmcgaw/gluetun:latest@sha256:c2ee4191762fca6b6a3c3359a731198a95d9c9af4db32d466e223bf3a84e779b
|
|
AddCapability=NET_ADMIN
|
|
AddDevice=/dev/net/tun:/dev/net/tun
|
|
Environment=VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
|
|
Environment=VPN_TYPE=${VPN_TYPE}
|
|
Environment=WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
|
|
Environment=WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
|
|
Environment=WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
|
|
Environment=WIREGUARD_ENDPOINT_IP=${WIREGUARD_ENDPOINT_IP}
|
|
Environment=WIREGUARD_ENDPOINT_PORT=${WIREGUARD_ENDPOINT_PORT}
|
|
Environment=WIREGUARD_ALLOWED_IPS=${WIREGUARD_ALLOWED_IPS}
|
|
Environment=WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}
|
|
PublishPort=8080:8080
|
|
PublishPort=6881:6881
|
|
PublishPort=6881:6881/udp
|
|
PublishPort=9696:9696
|
|
PublishPort=8989:8989
|
|
PublishPort=7878:7878
|
|
PublishPort=8686:8686
|
|
PublishPort=8787:8787
|
|
|
|
[Service]
|
|
EnvironmentFile=/home/core/Containers/gluetun/env
|
|
TimeoutStartSec=900
|
|
Restart=always
|
|
|
|
[Install]
|
|
WantedBy=default.target
|