92d450609c
- ops-agent/src/auth.ts: constant-time compare via timingSafeEqual to prevent timing attacks; store secret as Buffer - ops-agent/src/index.ts + ops-agent.service: bind on 127.0.0.1:3099 (was 4242, per plan) - app/api/agent/[...path]/route.ts: Next.js proxy route that verifies ops_session cookie then forwards requests to agent with Authorization: Bearer <secret> - .env.example + deploy/ops-dashboard.env.example: add OPS_AGENT_SECRET and OPS_AGENT_URL - README.md: rotation procedure for the shared secret Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
23 lines
571 B
Desktop File
23 lines
571 B
Desktop File
[Unit]
|
||
Description=Ops Agent – privileged command bridge for ops-dashboard
|
||
After=network.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
User=ops-agent
|
||
Group=ops-agent
|
||
WorkingDirectory=/opt/ops-agent
|
||
ExecStart=/usr/bin/node /opt/ops-agent/dist/index.js
|
||
Restart=on-failure
|
||
RestartSec=5s
|
||
StandardOutput=journal
|
||
StandardError=journal
|
||
SyslogIdentifier=ops-agent
|
||
|
||
Environment=OPS_AGENT_PORT=3099
|
||
Environment=OPS_AGENT_HOST=127.0.0.1
|
||
Environment=OPS_AGENT_WHITELIST_PATH=/etc/ops-agent/commands.yml
|
||
Environment=OPS_AGENT_SECRET_PATH=/etc/ops-agent/secret
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|