# Fallback transport (b): `ziti tunnel proxy` publishes the two mesh services on loopback so the
# agent (transport: proxy) can reach them without the Python SDK. Runs as user ziti with the
# SAME host identity ziti-edge-tunnel run-host uses. Enable only with `transport: proxy`.
#   monky.tenancy.deploy -> 127.0.0.1:18443   (plain HTTP inside the mesh)
#   openbao              -> 127.0.0.1:18200   (TLS end-to-end; SNI bao.cbs.tikali.net)
# NOTE: `ziti tunnel proxy` listens on IPv4 0.0.0.0 only (see project_openbao_consumer_gateway);
# the agent dials 127.0.0.1, so that is fine here.
[Unit]
Description=ziti tunnel proxy for monky-deployd (transport: proxy)
Documentation=https://scm.tikali.ai/tikali/applications/monky/monky-deployd
After=network-online.target
Wants=network-online.target
ConditionPathExists=/etc/monky-deployd/proxy.env

[Service]
Type=simple
User=ziti
Group=ziti
# proxy.env sets ZITI_IDENTITY=/opt/openziti/etc/identities/monky-host.<env>.json
EnvironmentFile=/etc/monky-deployd/proxy.env
ExecStart=/usr/bin/ziti tunnel proxy -i ${ZITI_IDENTITY} monky.tenancy.deploy:18443 openbao:18200
Restart=always
RestartSec=5s
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
CapabilityBoundingSet=
ReadOnlyPaths=-/opt/openziti/etc/identities
IPAddressDeny=any
IPAddressAllow=localhost
# the mesh edge routers are dialled by the ziti library itself: allow egress everywhere but
# only accept on loopback (the listeners bind 0.0.0.0 — IPAddressAllow above limits who connects)
IPAddressAllow=0.0.0.0/0 ::/0

[Install]
WantedBy=multi-user.target