swaits
1441dabcca
The books can live on a machine of the owner's own (plan 3.8, 8.2 P9a, D-51). Three things make that honest instead of nominal: - `--isolation same_user|enforced` sets `server::Isolation`, carried through `Served` and `BooksServer` to `books.start`. Locally the books stay `same_user (advisory)`; under the self-host unit the server is told `enforced` and reports `service_user (enforced)`. The server never guesses, and the literal it used to report is gone. - `--http [ADDR]` binds the same MCP router on loopback (default 127.0.0.1:7411) beside the Unix sockets, before the ready line, for the TLS proxy or tunnel in front of the server. It is the same bearer door and the same graceful close; a failed bind is reported and is not fatal (3.9). `serve` carries both flags through the host, so the system unit can ask for them once. `deploy/wanderbooks-server.service` is the unit: a dedicated account, a 0700 data root, `ProtectSystem=strict`, no seccomp or Landlock (D-32), and loopback-only networking. `deploy/README.md` is the recipe: install, setup, move the books by `books adopt` with its head check (D-31: a copied book is the transport), mint a bearer token, put Caddy or Tailscale Funnel in front of the loopback door, and point Claude Code and Codex at it. The two-account CI job (`.github/workflows/two-user.yml`) makes the deployment and runs `crates/ledger-cli/tests/two_user.rs` as another account: `agent_uid_cannot_read_tenant` proves the tenant root and its journal are refused, then reads, writes, uploads, files, exports and verifies over HTTP with the bearer (in a second book, so the moved books' head is not advanced); `self_host_adopt_same_head` compares the moved books' head and event count with the source clone's. `isolation_label_is_enforced_under_the_unit` runs everywhere, including the unit-file read that keeps the recipe from drifting. Accounting reason for the shape: nothing here changes an entry, a report or a figure. It changes who can reach them: the move is lossless and verifiable at the head, and the boundary is the operating system's, not a promise in our text. No journal code, kernel function, Kani harness or Lean step is touched, so `just prove` is not required. No go-ahead needed: no new journal feature or event; the live books are unaffected.
61 lines
2.3 KiB
Desktop File
61 lines
2.3 KiB
Desktop File
# The books on a machine of the owner's own (plan 8.2 P9a, section 3.8).
|
|
#
|
|
# One server, one account, one door. It runs `wanderbooks serve` as the
|
|
# dedicated account `wanderbooks`, over a data root only that account can
|
|
# read, and says `service_user (enforced)` in `books.start` (the flag; the
|
|
# server never guesses). Agents have no account on this machine and reach
|
|
# the books through the TLS door on 127.0.0.1:7411 (a tunnel or Caddy in
|
|
# front of it), with a static bearer token.
|
|
#
|
|
# No seccomp or Landlock lines: D-32 (no self-confinement) and D-51 (P9a
|
|
# is the recipe and the boundary between accounts, nothing more). What is
|
|
# here is the unit's own hardening of the account and the filesystem.
|
|
#
|
|
# Install: /usr/local/bin/wanderbooks is the server-only build
|
|
# (`cargo build --release -p ledger-cli --no-default-features`), and the
|
|
# root has been made once by `wanderbooks setup --root /srv/wanderbooks`
|
|
# as the wanderbooks account. See README.md in this folder for the steps.
|
|
|
|
[Unit]
|
|
Description=wanderbooks: the books server
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=wanderbooks
|
|
Group=wanderbooks
|
|
DynamicUser=no
|
|
# The account's own home (the keyring, when one runs; the recorded root).
|
|
StateDirectory=wanderbooks
|
|
Environment=HOME=/var/lib/wanderbooks
|
|
WorkingDirectory=/
|
|
# The books' data root, and the tunnel's door. `--isolation enforced` is
|
|
# what `books.start` reports; `--http` serves the same MCP service on
|
|
# 127.0.0.1 for Caddy or a tunnel. Drop `--http` if this machine has no
|
|
# TLS door.
|
|
ExecStart=/usr/local/bin/wanderbooks serve --root /srv/wanderbooks --isolation enforced --http 127.0.0.1:7411
|
|
# `serve` hears SIGTERM and lets go: the server finishes the call in
|
|
# progress, makes a last backup and closes. A long call is never cut off.
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=600
|
|
Restart=on-failure
|
|
RestartSec=2s
|
|
|
|
# The account and the filesystem (plan 3.8, 3.9).
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/srv/wanderbooks
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
# No network but loopback: the tunnel reaches 127.0.0.1:7411, and the
|
|
# server reaches nothing out. A book whose backup target is a remote git
|
|
# repository needs that host allowed here (`IPAddressAllow=` its address)
|
|
# or its backups fail; see README.md.
|
|
IPAddressDeny=any
|
|
IPAddressAllow=localhost
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|