40 lines
1.2 KiB
Django/Jinja
40 lines
1.2 KiB
Django/Jinja
{{ ansible_managed | comment }}
|
|
[Unit]
|
|
Description=Relay {{ item.name }} ({{ item.listen_address }}:{{ item.listen_port }} -> {{ item.target }})
|
|
After=network-online.target wg-quick@{{ wg_interface }}.service
|
|
Wants=network-online.target
|
|
{% if item.direction == 'inbound' %}
|
|
# Inbound listeners bind to the tunnel address, which doesn't exist until
|
|
# wg-quick has brought the interface up.
|
|
BindsTo=wg-quick@{{ wg_interface }}.service
|
|
{% endif %}
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/socat -d \
|
|
TCP-LISTEN:{{ item.listen_port }},bind={{ item.listen_address }},fork,reuseaddr,keepalive,keepidle=60,keepintvl=10,keepcnt=5 \
|
|
TCP:{{ item.target }},keepalive,keepidle=60,keepintvl=10,keepcnt=5
|
|
|
|
# Bind may fail for a few seconds after boot while wg0 settles; just retry.
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# socat needs no privileges beyond binding a high port.
|
|
User={{ socat_user }}
|
|
Group={{ socat_group }}
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
MemoryDenyWriteExecute=yes
|
|
CapabilityBoundingSet=
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|