openpencil/deploy/collab-relay-locator/openpencil-collab-cn-firewall-docker.conf

[Unit]
Requires=openpencil-collab-cn-firewall.service
After=openpencil-collab-cn-firewall.service

[Service]
# Reconcile after every daemon start as well as before it. A failed apply or
# verification makes Docker startup fail instead of exposing unguarded ports.
ExecStartPost=/usr/local/libexec/openpencil-collab-cn-firewall/apply-cn-docker-user-firewall.sh
ExecStartPost=/usr/local/libexec/openpencil-collab-cn-firewall/verify-cn-docker-user-firewall.sh
feat(deploy): collab-relay production configs, CN docker firewall, HSM locator Add production deployment configs for the collab relay and locator: region-split compose (CN/global), direct nginx gateways and location maps, the CN docker-user firewall install/verify/validate tooling and systemd unit, and an SoftHSM-backed locator variant. Extend the collab security/deployment boundary checks to cover the new artifacts. The CN application host address is a placeholder (10.0.0.10); substitute the real private address at deploy time. 2026-08-11 13:46:47 +00:00			`[Unit]`
			`Requires=openpencil-collab-cn-firewall.service`
			`After=openpencil-collab-cn-firewall.service`

			`[Service]`
			`# Reconcile after every daemon start as well as before it. A failed apply or`
			`# verification makes Docker startup fail instead of exposing unguarded ports.`
			`ExecStartPost=/usr/local/libexec/openpencil-collab-cn-firewall/apply-cn-docker-user-firewall.sh`
			`ExecStartPost=/usr/local/libexec/openpencil-collab-cn-firewall/verify-cn-docker-user-firewall.sh`