up

deploy/systemd/zastava-agent.env.sample

@@ -0,0 +1,26 @@
+# StellaOps Zastava Agent Configuration
+# Copy this file to /etc/stellaops/zastava-agent.env
+
+# Required: Tenant identifier for multi-tenancy
+ZASTAVA_TENANT=default
+
+# Required: Scanner backend URL
+ZASTAVA_AGENT__Backend__BaseAddress=https://scanner.internal
+
+# Optional: Node name (defaults to hostname)
+# ZASTAVA_NODE_NAME=
+
+# Optional: Docker socket endpoint (defaults to unix:///var/run/docker.sock)
+# ZASTAVA_AGENT__DockerEndpoint=unix:///var/run/docker.sock
+
+# Optional: Event buffer path (defaults to /var/lib/zastava-agent/runtime-events)
+# ZASTAVA_AGENT__EventBufferPath=/var/lib/zastava-agent/runtime-events
+
+# Optional: Health check port (defaults to 8080)
+# ZASTAVA_AGENT__HealthCheck__Port=8080
+
+# Optional: Allow insecure HTTP backend (NOT recommended for production)
+# ZASTAVA_AGENT__Backend__AllowInsecureHttp=false
+
+# Optional: Logging level
+# Serilog__MinimumLevel__Default=Information

deploy/systemd/zastava-agent.service

@@ -0,0 +1,58 @@
+[Unit]
+Description=StellaOps Zastava Agent - Container Runtime Monitor
+Documentation=https://docs.stellaops.org/zastava/agent/
+After=network-online.target docker.service containerd.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=notify
+ExecStart=/opt/stellaops/zastava-agent/StellaOps.Zastava.Agent
+WorkingDirectory=/opt/stellaops/zastava-agent
+Restart=always
+RestartSec=5
+
+# Environment configuration
+EnvironmentFile=-/etc/stellaops/zastava-agent.env
+Environment=DOTNET_ENVIRONMENT=Production
+Environment=ASPNETCORE_ENVIRONMENT=Production
+
+# User and permissions
+User=zastava-agent
+Group=docker
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+
+# Allow read access to Docker socket
+ReadWritePaths=/var/run/docker.sock
+ReadWritePaths=/var/lib/zastava-agent
+
+# Capabilities
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+# Resource limits
+LimitNOFILE=65536
+LimitNPROC=4096
+MemoryMax=512M
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=zastava-agent
+
+# Watchdog (5 minute timeout)
+WatchdogSec=300
+
+[Install]
+WantedBy=multi-user.target