anti
fcc9a9aad1
Wires the prefork primitive into a CLI command. 'decnet fleet heavy' imports the shared base floor once in the master, then forks profiler + ttp as CoW-sharing child processes (own process/GIL, full isolation, shared ~71MB floor). DB-only tier => systemd unit carries no extra privilege (prefork's privilege-union cost is nil for this fleet). Unit Conflicts= the profiler/ttp units it replaces. Heavy per-worker state (ATT&CK/ML) still loads per-child; warming it in the master to share is deferred until a live RSS measurement shows the big object graph CoW-shares rather than refcount-dirties.
49 lines
1.7 KiB
Django/Jinja
49 lines
1.7 KiB
Django/Jinja
[Unit]
|
|
Description=DECNET Heavy Fleet (prefork master forking profiler + ttp as CoW-sharing children)
|
|
Documentation=https://git.resacachile.cl/anti/DECNET/wiki/Workers#fleet
|
|
After=network-online.target decnet-bus.service
|
|
Wants=network-online.target decnet-bus.service
|
|
# Replaces the individual decnet-profiler / decnet-ttp units. Do NOT enable
|
|
# those alongside this one.
|
|
Conflicts=decnet-profiler.service decnet-ttp.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User={{ user }}
|
|
Group={{ group }}
|
|
WorkingDirectory={{ install_dir }}
|
|
EnvironmentFile=-{{ install_dir }}/.env.local
|
|
Environment=DECNET_SYSTEM_LOGS=/var/log/decnet/decnet.fleet-heavy.log
|
|
ExecStart={{ venv_dir }}/bin/decnet fleet heavy
|
|
StandardOutput=append:/var/log/decnet/decnet.fleet-heavy.log
|
|
StandardError=append:/var/log/decnet/decnet.fleet-heavy.log
|
|
|
|
# Prefork master imports the shared base floor once, then forks one child per
|
|
# worker; children share the floor via copy-on-write. Both members are DB-only
|
|
# (no docker socket, no raw sockets) so this unit carries NO extra privilege —
|
|
# the prefork privilege-union cost is nil for this fleet by construction.
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
|
|
# Security Hardening
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=full
|
|
# Dev installs under /home need ProtectHome=read-only: the ttp child reads
|
|
# ./rules/ttp/ from the project root (read-only suffices — YAML reads only).
|
|
ProtectHome=read-only
|
|
PrivateTmp=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
ReadWritePaths={{ install_dir }} /var/log/decnet
|
|
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
# Master forwards SIGTERM to children and reaps; give it room for both to drain.
|
|
TimeoutStopSec=25
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|