AgentServer/deploy/agent-server.service

# AgentServer systemd 服务（docs/design/06-security.md §5，ADR-0012）
# 以专用用户 agentsvc 运行：该用户不在 docker/lxd/sudo 组，Agent 失控时的影响上限是它自己的数据
[Unit]
Description=AgentServer
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=agentsvc
Group=agentsvc
WorkingDirectory=/srv/agent-server/app/server
Environment=NODE_ENV=production
Environment=HOME=/srv/agent-server/home
Environment=AGENT_SERVER_DATA_DIR=/srv/agent-server
Environment=AGENT_SERVER_ADMIN_DIST=/srv/agent-server/app/admin
# 监听所有网卡：局域网可直接访问，反向代理经 VPN 隧道（100.96.0.2）访问
Environment=AGENT_SERVER_HOST=0.0.0.0
# 反向代理 agent.zenpower.cc 经 VPN 隧道连入的地址，只信任它的 X-Forwarded-* 头
Environment=AGENT_SERVER_TRUST_PROXY=100.96.0.2
ExecStart=/usr/local/bin/node dist/main.js
Restart=on-failure
RestartSec=3

# 文件系统：整盘只读，home 不可见，只有服务数据可写；程序与运行环境由 root 所有、只读
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/srv/agent-server/home /srv/agent-server/data /srv/agent-server/managed-skills /srv/agent-server/workspaces /srv/agent-server/logs /srv/agent-server/knowledge
PrivateTmp=yes
UMask=0077
# 纵深防御：即使权限配置出错，也看不到这些高权限 socket
InaccessiblePaths=-/var/run/docker.sock -/run/docker.sock -/var/snap/lxd/common/lxd/unix.socket

# 内核与提权
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
LockPersonality=yes
# 不能开启 RestrictNamespaces：bubblewrap 沙箱需要 user/mount/net namespace

# 资源上限
MemoryMax=8G
CPUQuota=600%
TasksMax=1024

[Install]
WantedBy=multi-user.target