bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(guanghu-os): add authenticated native public projection

Browse source
This commit is contained in:
冰朔 2026-08-15 20:02:58 +08:00
commit 2e076c4d5e
14 changed files with 780 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

29
product-source/hololake-platform/guanghu-os/packaging/systemd/guanghu-native-public-projection-gateway.service Normal file
View file

@ -0,0 +1,29 @@
[Unit]
Description=Guanghu native public projection loopback shadow gateway
After=network.target
[Service]
Type=simple
User=guanghu-native-projection
Group=guanghu-native-projection
ExecStart=/usr/bin/python3 /usr/local/libexec/guanghu-os/native-public-projection-gateway.py --listen-host 127.0.0.1 --listen-port 19223 --state-file /var/lib/guanghu-native-projection/state.json --anchor-file /etc/guanghu-os/native-public-projection/anchor.json --code-file /etc/guanghu-os/native-public-projection/code-channel.json --expected-node JD-FD-PRIMARY --expected-relay BS-SG-003 --expected-candidate-sha256 9807fa751616d4b421c103d60eecface1c5eb8013cbd89417ef9e027da281fb3 --expected-source-commit fb1096c5ecdcfb36015d51273f487c2f36d9c9cd --max-age-seconds 15
Restart=on-failure
RestartSec=2
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ReadOnlyPaths=/etc/guanghu-os/native-public-projection
ReadWritePaths=/var/lib/guanghu-native-projection
RestrictAddressFamilies=AF_INET AF_INET6
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
UMask=0027
[Install]
WantedBy=multi-user.target

23
product-source/hololake-platform/guanghu-os/packaging/systemd/guanghu-native-public-projection-relay.service Normal file
View file

@ -0,0 +1,23 @@
[Unit]
Description=Project protected JD native residency state to the BS-GZ shadow receiver
After=network-online.target guanghu-jd-native-final-resident-relay.service
Wants=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/bin/python3 /usr/local/libexec/guanghu-os/native-public-projection-relay.py --relay-receipt /var/lib/guanghu-os/jd-final-resident-relay.hldp --max-receipt-age-seconds 15 --expected-nat-source 111.228.0.139 --node JD-FD-PRIMARY --relay BS-SG-003 --candidate-sha256 9807fa751616d4b421c103d60eecface1c5eb8013cbd89417ef9e027da281fb3 --source-commit fb1096c5ecdcfb36015d51273f487c2f36d9c9cd --ssh-config /etc/guanghu-os/native-public-projection-ssh.conf --ssh-target native-projection-gz
User=root
Group=root
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ReadOnlyPaths=/etc/guanghu-os /var/lib/guanghu-os/jd-final-resident-relay.hldp
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictSUIDSGID=yes
LockPersonality=yes
UMask=0077

11
product-source/hololake-platform/guanghu-os/packaging/systemd/guanghu-native-public-projection-relay.timer Normal file
View file

@ -0,0 +1,11 @@
[Unit]
Description=Refresh the Guanghu native public projection shadow state
[Timer]
OnBootSec=20s
OnUnitActiveSec=5s
AccuracySec=1s
Unit=guanghu-native-public-projection-relay.service
[Install]
WantedBy=timers.target