mirror of
https://gitcode.com/JianFeeeee/webui4frpc.git
synced 2026-10-31 06:17:20 +00:00
ee46b758fa
所有交付形态统一成「只传 -config」，凭据留在配置文件 / secrets 文件里。
- systemd 单元：ExecStart 改为 `-config /etc/webui4frpc/config.json`，
EnvironmentFile 加 `-` 前缀变成可选；新增 ReadOnlyPaths=-/etc/webui4frpc/secret。
- 新增 packaging/common/config.json 示例：口令默认用
file:/etc/webui4frpc/secret/password 引用，内嵌以 "_" 开头的说明键。
- webui4frpc.env 瘦身为可选环境变量（${VAR} 取值来源），不再承载明文口令。
- deb/rpm：安装 config.json 与 0750 的 secret 目录，config.json 进 conffiles，
安装后提示改成「设置 password 文件」。
- release.sh 的分发单元模板同步改 -config；tar.gz 附 config.json.example。
- macOS pkg：写 config.json + secret/password，launch 包装脚本只传 -config。
- Windows NSIS：安装时把口令写进 secret-password.txt（icacls 限制为
SYSTEM/Administrators），生成 data/config.json 用 file: 引用，启动脚本只传
-config；顺带按 JSON 规则转义 addr/user。makensis 实测可编译通过。
37 lines
1.3 KiB
Desktop File
37 lines
1.3 KiB
Desktop File
[Unit]
|
|
Description=webui4frpc - visual frpc controller (cluster node)
|
|
Documentation=https://gitcode.com/JianFeeeee/webui4frpc
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=webui4frpc
|
|
Group=webui4frpc
|
|
# The listening address, admin credentials and cluster peers live in
|
|
# config.json, NOT on the command line: anything in ExecStart is visible to
|
|
# every user via `ps` and in the unit file itself. Keep the password out of
|
|
# this unit — put it in config.json as "file:/etc/webui4frpc/secret/password"
|
|
# (or "${W4F_PASSWORD}" with an EnvironmentFile), never as -password.
|
|
# The leading "-" makes the EnvironmentFile optional, so a node that keeps all
|
|
# settings in config.json still starts.
|
|
EnvironmentFile=-/etc/webui4frpc/webui4frpc.env
|
|
ExecStart=/usr/bin/webui4frpc -config /etc/webui4frpc/config.json
|
|
Restart=always
|
|
RestartSec=5
|
|
LimitNOFILE=65535
|
|
|
|
# hardening
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=full
|
|
ProtectHome=true
|
|
ReadWritePaths=/var/lib/webui4frpc
|
|
# config.json may point at a root-only secrets file for the admin password.
|
|
# That path needs to be readable by this service account; keep such files in
|
|
# /etc/webui4frpc/secret/ with mode 0640 root:webui4frpc.
|
|
ReadOnlyPaths=-/etc/webui4frpc/secret
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|