Validate configuration at startup; production mode rejects missing keys, unsafe defaults, or ambiguous public endpoints.
Implement graceful drain: reject new registrations/joins, finish or time out bounded attempts, stop listeners, and exit.
Document restart/re-registration, rollback, backup of only durable configuration/key material, and upgrade procedure.
Provide HTTP+UDP smoke checks.
Acceptance criteria
A clean checkout builds and runs the pinned image.
Container runs non-root with no required writable application directory.
Real smoke tests reach both HTTP and UDP through the documented topology.
Required production secrets/configuration fail closed with actionable errors.
Graceful SIGTERM drains within a configured deadline and leaves no hanging process/socket.
Proxy/load-balancer documentation warns when source/reply address preservation cannot be guaranteed.
No ephemeral listing/endpoint state is misrepresented as durable.
Parent: #1
Depends on: #16
## Outcome
Ship a reproducible single-active Linux deployment that exposes HTTP and UDP correctly and fails closed when misconfigured.
## Scope
- Add a multi-stage, pinned, non-root container with a minimal/read-only runtime surface and explicit HTTP/UDP ports.
- Add local Compose and optional systemd deployment examples.
- Document DNS, TLS termination, trusted proxies, source-IP-preserving UDP ingress, firewall rules, secret injection, resource limits, and clock requirements.
- Validate configuration at startup; production mode rejects missing keys, unsafe defaults, or ambiguous public endpoints.
- Implement graceful drain: reject new registrations/joins, finish or time out bounded attempts, stop listeners, and exit.
- Document restart/re-registration, rollback, backup of only durable configuration/key material, and upgrade procedure.
- Provide HTTP+UDP smoke checks.
## Acceptance criteria
- A clean checkout builds and runs the pinned image.
- Container runs non-root with no required writable application directory.
- Real smoke tests reach both HTTP and UDP through the documented topology.
- Required production secrets/configuration fail closed with actionable errors.
- Graceful SIGTERM drains within a configured deadline and leaves no hanging process/socket.
- Proxy/load-balancer documentation warns when source/reply address preservation cannot be guaranteed.
- No ephemeral listing/endpoint state is misrepresented as durable.
Starting #17 on codex/issue-17-secure-linux-deployment, stacked on verified #16 commit be732de. I’ll deliver the pinned non-root/read-only container, fail-closed production configuration, graceful SIGTERM drain, Compose/systemd examples, source-preserving HTTP+UDP deployment guidance, and real HTTP+UDP smoke gates before committing and pushing.
Starting #17 on `codex/issue-17-secure-linux-deployment`, stacked on verified #16 commit `be732de`. I’ll deliver the pinned non-root/read-only container, fail-closed production configuration, graceful SIGTERM drain, Compose/systemd examples, source-preserving HTTP+UDP deployment guidance, and real HTTP+UDP smoke gates before committing and pushing.
read-only/non-root Compose and hardened systemd deployment shapes
external file-backed signing secrets with bounded reads and symlink rejection
fail-closed Production validation for topology, trusted proxy, AllowedHosts, single-active state, ports, deadlines, and globally routable advertised endpoints
bounded graceful drain that rejects new work, preserves listeners for existing attempts, expires due attempts without full-state sweeps, then clears ephemeral state
parameterized authenticated HTTP+UDP deployment smoke, complete Linux operations/recovery/upgrade/rollback guidance, and a required real-container CI gate
Verification:
adversarial multi-lens branch audit: no remaining findings after fixes and re-review
Debug: 282/282 tests passed
Release: 282/282 tests passed
Release build and formatting verification passed
Docker image rebuilt cleanly with pinned frontend/base digests
live Compose smoke passed authenticated HTTP + UDP mediation/direct traffic as 1654:1654 with read-only root and read-only config/key mounts
SIGTERM drain completed in ~2 seconds; container exited 0 with PID 0 and released TCP 8080 + UDP 9050
Compose config, shell syntax, systemd unit, generated API drift, and diff hygiene checks passed
The issue remains open while the dependency-ordered roadmap branch stack continues; it can be reconciled when the stack lands.
Implemented and pushed on `codex/issue-17-secure-linux-deployment` in commit `08729ae`.
Delivered:
- digest-pinned multi-stage .NET 10 chiseled image, UID/GID 1654, explicit TCP 8080 + UDP 9050
- read-only/non-root Compose and hardened systemd deployment shapes
- external file-backed signing secrets with bounded reads and symlink rejection
- fail-closed Production validation for topology, trusted proxy, AllowedHosts, single-active state, ports, deadlines, and globally routable advertised endpoints
- bounded graceful drain that rejects new work, preserves listeners for existing attempts, expires due attempts without full-state sweeps, then clears ephemeral state
- parameterized authenticated HTTP+UDP deployment smoke, complete Linux operations/recovery/upgrade/rollback guidance, and a required real-container CI gate
Verification:
- adversarial multi-lens branch audit: no remaining findings after fixes and re-review
- Debug: 282/282 tests passed
- Release: 282/282 tests passed
- Release build and formatting verification passed
- Docker image rebuilt cleanly with pinned frontend/base digests
- live Compose smoke passed authenticated HTTP + UDP mediation/direct traffic as `1654:1654` with read-only root and read-only config/key mounts
- SIGTERM drain completed in ~2 seconds; container exited 0 with PID 0 and released TCP 8080 + UDP 9050
- Compose config, shell syntax, systemd unit, generated API drift, and diff hygiene checks passed
The issue remains open while the dependency-ordered roadmap branch stack continues; it can be reconciled when the stack lands.
Shipped in v1.0.0: the hardened container (read-only, non-root, cap-drop, no-new-privileges) is the released image, deployed in production shape on the foxden test VM behind TLS-terminating nginx with the mediator on direct UDP; the compose bundle is exercised by CI's deployment smoke on every build.
Shipped in [v1.0.0](https://git.finalfactory.de/HeiKyu/Rendezvous/releases/tag/v1.0.0): the hardened container (read-only, non-root, cap-drop, no-new-privileges) is the released image, deployed in production shape on the foxden test VM behind TLS-terminating nginx with the mediator on direct UDP; the compose bundle is exercised by CI's deployment smoke on every build.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #1
Depends on: #16
Outcome
Ship a reproducible single-active Linux deployment that exposes HTTP and UDP correctly and fails closed when misconfigured.
Scope
Acceptance criteria
Starting #17 on
codex/issue-17-secure-linux-deployment, stacked on verified #16 commitbe732de. I’ll deliver the pinned non-root/read-only container, fail-closed production configuration, graceful SIGTERM drain, Compose/systemd examples, source-preserving HTTP+UDP deployment guidance, and real HTTP+UDP smoke gates before committing and pushing.Implemented and pushed on
codex/issue-17-secure-linux-deploymentin commit08729ae.Delivered:
Verification:
1654:1654with read-only root and read-only config/key mountsThe issue remains open while the dependency-ordered roadmap branch stack continues; it can be reconciled when the stack lands.
Shipped in v1.0.0: the hardened container (read-only, non-root, cap-drop, no-new-privileges) is the released image, deployed in production shape on the foxden test VM behind TLS-terminating nginx with the mediator on direct UDP; the compose bundle is exercised by CI's deployment smoke on every build.