a39406c12b
Add production deployment configs for the collab relay and locator: region-split compose (CN/global), direct nginx gateways and location maps, the CN docker-user firewall install/verify/validate tooling and systemd unit, and an SoftHSM-backed locator variant. Extend the collab security/deployment boundary checks to cover the new artifacts. The CN application host address is a placeholder (10.0.0.10); substitute the real private address at deploy time.
10 lines
457 B
Plaintext
10 lines
457 B
Plaintext
[Unit]
|
|
Requires=openpencil-collab-cn-firewall.service
|
|
After=openpencil-collab-cn-firewall.service
|
|
|
|
[Service]
|
|
# Reconcile after every daemon start as well as before it. A failed apply or
|
|
# verification makes Docker startup fail instead of exposing unguarded ports.
|
|
ExecStartPost=/usr/local/libexec/openpencil-collab-cn-firewall/apply-cn-docker-user-firewall.sh
|
|
ExecStartPost=/usr/local/libexec/openpencil-collab-cn-firewall/verify-cn-docker-user-firewall.sh
|