2ro
fba3e6ff03
- gp-server.service: drop the GP_MNEMONIC credential from the default unit (the seed lives only encrypted at rest + the operator's written backup); keep GP_WALLET_PASSWORD_FILE via LoadCredential. A commented first-boot-only bootstrap remains for the no-wizard path. - install.sh: end by offering to run `gp-server setup` (no longer pre-writes the env file, which would block the wizard's re-run guard). - package-woocommerce.sh: build goblinpay-woocommerce.zip (single top-level folder) as a release artifact. - WooCommerce plugin: fix the default server URL port (8192 -> 8080) to match the server's default bind; same fix in the connector README/INSTALL.
91 lines
3.7 KiB
Desktop File
91 lines
3.7 KiB
Desktop File
# Hardened systemd unit for the GoblinPay server on bare metal.
|
|
#
|
|
# The recommended path is the setup wizard, which writes everything this unit
|
|
# reads (the env file and the 0400 wallet-password credential) and creates the
|
|
# encrypted wallet for you:
|
|
# sudo install -m0644 deploy/gp-server.service /etc/systemd/system/
|
|
# sudo gp-server setup # writes /etc/goblinpay.env + the secret file
|
|
# sudo systemctl daemon-reload && sudo systemctl enable --now gp-server
|
|
#
|
|
# Unlike goblin-nip05d, this service holds a MONEY secret (the wallet password,
|
|
# which decrypts the Grin seed at rest) and a wallet data directory. The
|
|
# password is passed as a systemd credential (read by PID1 as root, exposed
|
|
# read-only to the dynamic service user) rather than left world-readable.
|
|
#
|
|
# The Grin SEED is deliberately NOT a service credential: the wizard consumes it
|
|
# once at setup to create the encrypted wallet, after which the wallet opens
|
|
# with the password alone (init-once). The seed then lives only encrypted at
|
|
# rest in the data dir and in the operator's written backup, never in this
|
|
# service's environment. (To bootstrap a wallet WITHOUT the wizard, set
|
|
# GP_MNEMONIC_FILE for the first boot only, then remove it.)
|
|
|
|
[Unit]
|
|
Description=GoblinPay — self-hostable, receive-only Grin payment server
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
# Throwaway unprivileged user allocated at runtime. For a stable data owner,
|
|
# comment this out and set `User=goblinpay` (create the user first).
|
|
DynamicUser=yes
|
|
|
|
# Non-secret config (domain, node, tokens, webhook, relay URL). Read by systemd
|
|
# as root, so a 0640 root:root file is fine even under DynamicUser.
|
|
EnvironmentFile=/etc/goblinpay.env
|
|
|
|
# The wallet password as a credential: the source file stays root-owned 0400
|
|
# (the wizard writes it there); systemd exposes a copy under
|
|
# $CREDENTIALS_DIRECTORY (%d), readable by the dynamic service user. The wallet
|
|
# is pointed at it via the *_FILE variant. This overrides any GP_WALLET_PASSWORD_FILE
|
|
# in the env file above, so the service always reads the credential copy.
|
|
LoadCredential=gp_wallet_password:/etc/goblinpay/secrets/wallet_password
|
|
Environment=GP_WALLET_PASSWORD_FILE=%d/gp_wallet_password
|
|
# First-boot-only seed bootstrap WITHOUT the wizard (remove after the wallet
|
|
# exists). The wizard makes this unnecessary.
|
|
#LoadCredential=gp_mnemonic:/etc/goblinpay/secrets/mnemonic
|
|
#Environment=GP_MNEMONIC_FILE=%d/gp_mnemonic
|
|
# Optional: a NIP-49 encrypted Nostr identity (else a random one is generated
|
|
# and persisted under the data dir on first start). Uncomment with its file:
|
|
#LoadCredential=gp_ncryptsec:/etc/goblinpay/secrets/ncryptsec
|
|
#Environment=GP_NCRYPTSEC_FILE=%d/gp_ncryptsec
|
|
|
|
# Managed state at /var/lib/goblinpay: the SQLite db, the wallet files, and the
|
|
# encrypted seed at rest. 0700 — only the service user may read it.
|
|
StateDirectory=goblinpay
|
|
StateDirectoryMode=0700
|
|
Environment=GP_DB_PATH=/var/lib/goblinpay/goblinpay.db
|
|
Environment=GP_DATA_DIR=/var/lib/goblinpay/gp-data
|
|
|
|
ExecStart=/usr/local/bin/gp-server
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
|
|
# --- hardening ---
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
# If the Nym mixnet stack ever fails to start with a W^X error, comment this out.
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources
|
|
# Only the state directory is writable.
|
|
ReadWritePaths=/var/lib/goblinpay
|
|
# No raw sockets; only IP + unix.
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|