deploy/crushdb.service runs run.py on 127.0.0.1:8085 with auto-restart
and hardening (ProtectSystem=strict, ReadWritePaths only for the SQLite
dir, no capabilities, restricted address families). Verified with
systemd-analyze verify against locally substituted paths (exit 0); the
only remaining warning on the un-substituted unit is the expected
path-not-found for the deployment location in this dev checkout.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
User's proxy expects the upstream on port 8085; defaults are aligned
across run.py, the systemd unit and the docs.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Adds deploy/crushdb.service: plain HTTP on 127.0.0.1:5000 (HOST/PORT
env), auto-restart on failure, hardened with ProtectSystem/strict,
NoNewPrivileges, capability drop and restricted address families so
only the SQLite dir and private tmp are writable. Passes
systemd-analyze verify (the one reported warning is the expected
/path-in-this-repo venv path of the source checkout, not the deployed
one).
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
jhkaktus