William Gill
12bf35caf8
Greenfield Go multi-tenant IPFS Pinning Service wire-compatible with the
IPFS Pinning Services API spec. Paired 1:1 with Kubo over localhost RPC,
clustered via embedded NATS JetStream, Postgres source-of-truth with
RLS-enforced tenancy, Fiber + huma v2 for the HTTP surface, Authentik
OIDC for session login with kid-rotated HS256 JWT API tokens.
Feature-complete against the 22-milestone build plan, including the
ship-it v1.0 gap items:
* admin CLIs: drain/uncordon, maintenance, mint-token, rotate-key,
prune-denylist, rebalance --dry-run, cache-stats, cluster-presences
* TTL leader election via NATS KV, fence tokens, JetStream dedup
* rebalancer (plan/apply split), reconciler, requeue sweeper
* ristretto caches with NATS-backed cross-node invalidation
(placements live-nodes + token denylist)
* maintenance watchdog for stuck cluster-pause flag
* Prometheus /metrics with CIDR ACL, HTTP/pin/scheduler/cache gauges
* rate limiting: session (10/min) + anonymous global (120/min)
* integration tests: rebalance, refcount multi-org, RLS belt
* goreleaser (tar + deb/rpm/apk + Alpine Docker) targeting Gitea
Stack: Cobra/Viper, Fiber v2 + huma v2, embedded NATS JetStream,
pgx/sqlc/golang-migrate, ristretto, TypeID, prometheus/client_golang,
testcontainers-go.
49 lines
1.3 KiB
Desktop File
49 lines
1.3 KiB
Desktop File
[Unit]
|
|
Description=anchorage IPFS Pinning Service
|
|
Documentation=https://git.anomalous.dev/alphacentri/anchorage
|
|
Wants=network-online.target
|
|
After=network.target network-online.target postgresql.service ipfs.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=anchorage
|
|
Group=anchorage
|
|
WorkingDirectory=/etc/anchorage
|
|
LimitNOFILE=65536
|
|
|
|
ExecStart=/usr/bin/anchorage serve --config /etc/anchorage/anchorage.yaml
|
|
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
StartLimitInterval=60
|
|
StartLimitBurst=3
|
|
|
|
# Security hardening — anchorage is a pure-Go HTTP/NATS daemon, no
|
|
# special capabilities required. The writable paths are the state dir
|
|
# (node.id, NATS JetStream data) and the log dir.
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
NoNewPrivileges=true
|
|
RestrictRealtime=true
|
|
RestrictNamespaces=true
|
|
MemoryDenyWriteExecute=true
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources @mount @debug
|
|
|
|
ReadWritePaths=/var/lib/anchorage /var/log/anchorage
|
|
|
|
# Allow binding to ports < 1024 (e.g. :443 behind a reverse proxy terminator).
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|