feat(deployment): add secure Linux runtime (#17)

2026-07-16 15:03:04 +02:00
parent be732de7c9
commit 08729ae25c
23 changed files with 1941 additions and 28 deletions
@@ -0,0 +1,58 @@
+{
+  "AllowedHosts": "localhost;127.0.0.1",
+  "Rendezvous": {
+    "Deployment": {
+      "PublicHttpBaseUrl": "https://localhost/",
+      "PublicUdpHost": "127.0.0.1",
+      "PublicUdpPort": 9050,
+      "DrainDeadlineSeconds": 30,
+      "MinimumDrainSeconds": 1,
+      "SingleActiveInstance": true,
+      "AllowPrivatePublicEndpoints": true
+    },
+    "Udp": {
+      "ListenAddress": "0.0.0.0",
+      "Port": 9050
+    },
+    "AbuseProtection": {
+      "TrustedProxyAddresses": ["127.0.0.1"],
+      "OperatorAllowedAddresses": ["127.0.0.1"]
+    },
+    "Provisioning": {
+      "Issuer": "final-factory-rendezvous-smoke",
+      "Audience": "rendezvous-service",
+      "ClockSkewSeconds": 30,
+      "SigningKeys": [
+        {
+          "KeyId": "local-smoke-1",
+          "SecretReference": "file:/run/secrets/rendezvous-signing-key",
+          "CredentialKinds": ["DedicatedPublisher"],
+          "GameId": "space-game",
+          "EnvironmentId": "smoke",
+          "NotBefore": "2026-01-01T00:00:00Z",
+          "SignUntil": "2100-01-01T00:00:00Z",
+          "VerifyUntil": "2100-01-02T00:00:00Z"
+        }
+      ],
+      "Games": [
+        {
+          "GameId": "space-game",
+          "EnvironmentId": "smoke",
+          "Enabled": true,
+          "ProtocolVersions": [1],
+          "Regions": ["local"],
+          "VisibilityModes": ["Public"],
+          "PublisherTrustModes": ["ManagedDedicated"],
+          "MetadataValueMaxBytes": {},
+          "RequiredMetadataKeys": [],
+          "MetadataMaxBytes": 512,
+          "MetadataMaxKeys": 0,
+          "MaxListingsPerPrincipal": 10,
+          "MaxAnonymousListingsPerAddress": 0,
+          "MaxActiveJoinAttempts": 100,
+          "FallbackPolicy": "Disabled"
+        }
+      ]
+    }
+  }
+}
@@ -0,0 +1,35 @@
+name: rendezvous-local
+
+services:
+  rendezvous:
+    image: finalfactory/rendezvous:local
+    build:
+      context: ../..
+      dockerfile: Dockerfile
+    init: true
+    user: "${RENDEZVOUS_UID:?set RENDEZVOUS_UID to a non-root host UID}:${RENDEZVOUS_GID:?set RENDEZVOUS_GID to its GID}"
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=16m,uid=${RENDEZVOUS_UID},gid=${RENDEZVOUS_GID},mode=0700
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 128
+    mem_limit: 512m
+    cpus: 1.0
+    ulimits:
+      nofile:
+        soft: 4096
+        hard: 4096
+    stop_grace_period: 40s
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_ENVIRONMENT: Production
+      ASPNETCORE_HTTP_PORTS: "8080"
+    volumes:
+      - ./appsettings.Production.json:/app/appsettings.Production.json:ro
+      - ./secrets/signing-key:/run/secrets/rendezvous-signing-key:ro
+    ports:
+      - "127.0.0.1:8080:8080/tcp"
+      - "9050:9050/udp"
@@ -0,0 +1,2 @@
+*
+!.gitignore