Hardened systemd deployment contract for read-only Monero observer

2026-10-22 10:08:15 -04:00
parent 158981e965
commit e835238d05
12 changed files with 170 additions and 7 deletions
@@ -10,6 +10,7 @@ async function secretFile(path: string | undefined): Promise<string> {
  if (!path) throw new Error('Custody PostgreSQL secret file is required');
  const info = await lstat(path);
  if (!info.isFile() || info.isSymbolicLink() || info.size > 16384 || info.size === 0) throw new Error('Invalid PostgreSQL secret file');
+  if (process.platform !== 'win32' && (info.mode & 0o077) !== 0) throw new Error('PostgreSQL secret file permissions are too broad');
  return (await readFile(path, 'utf8')).trim();
 }
 /** No URL logging, no TLS options in a connection string overriding verified transport. */