feat: establish standalone Device Core repository

2026-08-21 11:51:21 +03:00
commit e0bac205d0
244 changed files with 51962 additions and 0 deletions
@@ -0,0 +1,16 @@
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PermitRootLogin prohibit-password
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+X11Forwarding no
+AllowAgentForwarding no
+AllowTcpForwarding no
+GatewayPorts no
+PermitTunnel no
+PermitUserEnvironment no
+MaxAuthTries 3
+LoginGraceTime 20
+ClientAliveInterval 60
+ClientAliveCountMax 3
+UseDNS no
@@ -0,0 +1,23 @@
+Host device-backhaul-target
+  HostName 100.109.216.21
+  Port 2222
+  User device-backhaul
+  AddressFamily inet
+  IdentityFile /var/lib/nodedc-b2-vps/trust/backhaul_ed25519
+  IdentitiesOnly yes
+  PreferredAuthentications publickey
+  PasswordAuthentication no
+  KbdInteractiveAuthentication no
+  StrictHostKeyChecking yes
+  UserKnownHostsFile /var/lib/nodedc-b2-vps/trust/backhaul_known_hosts
+  GlobalKnownHostsFile /dev/null
+  ProxyCommand /usr/bin/nc -X 5 -x 127.0.0.1:1055 %h %p
+  LocalForward 127.0.0.1:19921 127.0.0.1:9921
+  ExitOnForwardFailure yes
+  ServerAliveInterval 30
+  ServerAliveCountMax 3
+  TCPKeepAlive yes
+  ClearAllForwardings no
+  RequestTTY no
+  SessionType none
+  LogLevel VERBOSE
@@ -0,0 +1,26 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+    tcp dport 443 ct state new limit rate 120/minute burst 120 packets accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}
@@ -0,0 +1,22 @@
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}
@@ -0,0 +1,24 @@
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+    tcp dport 9921 ct state new limit rate over 300/second drop
+    tcp dport 9921 accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}
@@ -0,0 +1,27 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+    tcp dport 443 ct state new limit rate 120/minute burst 120 packets accept
+    tcp dport 9921 ct state new limit rate 600/minute burst 128 packets accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}
@@ -0,0 +1,247 @@
+import { createServer } from "node:http";
+import { pathToFileURL } from "node:url";
+
+import {
+  DEVICE_ADAPTER_CATALOG,
+} from "../../packages/device-adapter-catalog/src/index.mjs";
+import {
+  createDeviceEdgeChannelServer,
+} from "../../services/device-edge-channel/src/runtime.mjs";
+import {
+  readRuntimeConfiguration,
+} from "../../services/device-edge-channel/src/server.mjs";
+import {
+  createDeviceGatewayRuntime,
+} from "../../services/device-gateway/src/runtime.mjs";
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await main();
+}
+
+export async function main(environment = process.env) {
+  const base = await readRuntimeConfiguration(environment);
+  const tracker = normalizeTrackerIngressConfiguration(
+    environment,
+    base.channel.edgeRegistrationId,
+  );
+  const channel = createDeviceEdgeChannelServer({
+    ...base.channel,
+    commandTransport: "typed-service-ping-v1",
+  });
+  const gateway = createDeviceGatewayRuntime({
+    listenEnabled: true,
+    publicIngressEnabled: true,
+    coreChannelAuthenticated: true,
+    adapterRegistry: DEVICE_ADAPTER_CATALOG.registry,
+    protocolProfileRef: tracker.protocolProfileRef,
+    edgeRef: tracker.edgeRef,
+    healthHost: tracker.healthHost,
+    healthPort: tracker.healthPort,
+    tcpHost: tracker.tcpHost,
+    tcpPort: tracker.tcpPort,
+    maxBufferedBytes: tracker.maxBufferedBytes,
+    maxAggregateBufferedBytes: tracker.maxAggregateBufferedBytes,
+    maxConcurrentSessions: tracker.maxConcurrentSessions,
+    maxSessionsPerAddress: tracker.maxSessionsPerAddress,
+    maxConnectionsPerMinutePerAddress:
+      tracker.maxConnectionsPerMinutePerAddress,
+    maxTrackedSourceAddresses: tracker.maxTrackedSourceAddresses,
+    sessionTimeoutMs: tracker.sessionTimeoutMs,
+    onDiscovery: (signal) => channel.submitDiscovery(signal),
+    onMessage: (message) => channel.submitAdapterMessage(message),
+    onCommandStatus: (status) => channel.submitCommandStatus(status),
+  });
+  const health = createCombinedHealthServer(channel, gateway, base.health);
+  let stopping = false;
+
+  try {
+    await channel.start();
+    await gateway.start();
+    await listen(health, base.health.port, base.health.host);
+  } catch (error) {
+    await Promise.allSettled([
+      gateway.stop(),
+      channel.stop(),
+      closeServer(health),
+    ]);
+    throw error;
+  }
+
+  console.log(JSON.stringify({
+    event: "device_edge_runtime_started",
+    channel: `${base.channel.host}:${base.channel.port}`,
+    health: `${base.health.host}:${base.health.port}`,
+    trackerIngress: `${tracker.tcpHost}:${tracker.tcpPort}`,
+    adapterProfile: tracker.protocolProfileRef,
+    edgeRegistrationId: base.channel.edgeRegistrationId,
+    channelGeneration: base.channel.channelGeneration,
+    trustGeneration: base.channel.trustGeneration,
+    commandTransport: "typed-service-ping-v1",
+  }));
+
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+
+  async function shutdown() {
+    if (stopping) return;
+    stopping = true;
+    await Promise.allSettled([
+      gateway.stop(),
+      channel.stop(),
+      closeServer(health),
+    ]);
+    process.exit(0);
+  }
+}
+
+export function normalizeTrackerIngressConfiguration(environment = {}, edgeRef) {
+  return Object.freeze({
+    edgeRef: normalizeRef(edgeRef, "device_edge_runtime_edge_ref_invalid"),
+    protocolProfileRef: normalizeProfileRef(
+      environment.DEVICE_GATEWAY_PROTOCOL_PROFILE_REF
+        ?? DEVICE_ADAPTER_CATALOG.defaultProfileRef,
+    ),
+    healthHost: normalizeLoopbackHost(
+      environment.DEVICE_GATEWAY_HEALTH_HOST ?? "127.0.0.1",
+    ),
+    healthPort: normalizePort(environment.DEVICE_GATEWAY_HEALTH_PORT, 18221),
+    tcpHost: normalizePublicHost(
+      environment.DEVICE_GATEWAY_TCP_HOST ?? "0.0.0.0",
+    ),
+    tcpPort: normalizePort(environment.DEVICE_GATEWAY_TCP_PORT, 9921),
+    maxBufferedBytes: normalizeInteger(
+      environment.DEVICE_GATEWAY_MAX_BUFFERED_BYTES,
+      64 * 1024,
+      1024,
+      256 * 1024,
+      "device_edge_runtime_session_buffer_invalid",
+    ),
+    maxAggregateBufferedBytes: normalizeInteger(
+      environment.DEVICE_GATEWAY_MAX_AGGREGATE_BUFFERED_BYTES,
+      32 * 1024 * 1024,
+      1024,
+      32 * 1024 * 1024,
+      "device_edge_runtime_aggregate_buffer_invalid",
+    ),
+    maxConcurrentSessions: normalizeInteger(
+      environment.DEVICE_GATEWAY_MAX_SESSIONS,
+      128,
+      1,
+      128,
+      "device_edge_runtime_session_limit_invalid",
+    ),
+    maxSessionsPerAddress: normalizeInteger(
+      environment.DEVICE_GATEWAY_MAX_SESSIONS_PER_ADDRESS,
+      16,
+      1,
+      16,
+      "device_edge_runtime_address_session_limit_invalid",
+    ),
+    maxConnectionsPerMinutePerAddress: normalizeInteger(
+      environment.DEVICE_GATEWAY_MAX_CONNECTIONS_PER_MINUTE_PER_ADDRESS,
+      60,
+      1,
+      60,
+      "device_edge_runtime_address_rate_limit_invalid",
+    ),
+    maxTrackedSourceAddresses: normalizeInteger(
+      environment.DEVICE_GATEWAY_MAX_TRACKED_SOURCE_ADDRESSES,
+      2048,
+      1,
+      2048,
+      "device_edge_runtime_source_tracking_limit_invalid",
+    ),
+    sessionTimeoutMs: normalizeInteger(
+      environment.DEVICE_GATEWAY_SESSION_TIMEOUT_MS,
+      10_000,
+      100,
+      60_000,
+      "device_edge_runtime_session_timeout_invalid",
+    ),
+  });
+}
+
+function createCombinedHealthServer(channel, gateway, healthConfig) {
+  return createServer((request, response) => {
+    response.setHeader("Content-Type", "application/json; charset=utf-8");
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("X-Content-Type-Options", "nosniff");
+    if (request.method !== "GET" || request.url !== "/healthz") {
+      response.statusCode = 404;
+      response.end(JSON.stringify({ ok: false, error: "not_found" }));
+      return;
+    }
+    response.statusCode = 200;
+    response.end(JSON.stringify({
+      ok: true,
+      service: "nodedc-device-edge-runtime",
+      health: `${healthConfig.host}:${healthConfig.port}`,
+      ...channel.status(),
+      trackerIngress: "telemetry-ingest",
+      tracker: gateway.status(),
+      commandTransport: "typed-service-ping-v1",
+    }));
+  });
+}
+
+function normalizeRef(value, errorCode) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value)) {
+    throw new TypeError(errorCode);
+  }
+  return value;
+}
+
+function normalizeProfileRef(value) {
+  if (typeof value !== "string" || !/^[a-z][a-z0-9._-]{2,127}$/.test(value)) {
+    throw new TypeError("device_edge_runtime_profile_ref_invalid");
+  }
+  DEVICE_ADAPTER_CATALOG.registry.resolveProfile(value);
+  return value;
+}
+
+function normalizeLoopbackHost(value) {
+  if (!["127.0.0.1", "::1"].includes(value)) {
+    throw new TypeError("device_edge_runtime_health_host_invalid");
+  }
+  return value;
+}
+
+function normalizePublicHost(value) {
+  if (!["0.0.0.0", "::"].includes(value)) {
+    throw new TypeError("device_edge_runtime_public_host_invalid");
+  }
+  return value;
+}
+
+function normalizePort(value, fallback) {
+  return normalizeInteger(
+    value,
+    fallback,
+    1,
+    65_535,
+    "device_edge_runtime_port_invalid",
+  );
+}
+
+function normalizeInteger(value, fallback, minimum, maximum, errorCode) {
+  const normalized = Number(value ?? fallback);
+  if (!Number.isSafeInteger(normalized) || normalized < minimum || normalized > maximum) {
+    throw new TypeError(errorCode);
+  }
+  return normalized;
+}
+
+function listen(server, port, host) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+}
+
+function closeServer(server) {
+  if (!server.listening) return Promise.resolve();
+  return new Promise((resolve) => server.close(() => resolve()));
+}
@@ -0,0 +1,33 @@
+[Unit]
+Description=NODE.DC B2 VPS encrypted private backhaul
+After=network-online.target nodedc-b2-tailscaled.service
+Wants=network-online.target
+Requires=nodedc-b2-tailscaled.service
+
+[Service]
+Type=simple
+User=nodedc-backhaul
+Group=nodedc-backhaul
+ExecStart=/usr/bin/ssh -N -F /opt/nodedc-b2-vps/config/backhaul_ssh_config device-backhaul-target
+Restart=always
+RestartSec=3s
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+MemoryMax=64M
+TasksMax=32
+LimitNOFILE=1024
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,48 @@
+[Unit]
+Description=NODE.DC B2 VPS bounded raw TCP relay
+After=network-online.target nodedc-b2-backhaul.service
+Wants=network-online.target
+Requires=nodedc-b2-backhaul.service
+
+[Service]
+Type=simple
+User=nodedc-relay
+Group=nodedc-relay
+WorkingDirectory=/opt/nodedc-b2-vps
+Environment=DEVICE_EDGE_RELAY_HEALTH_HOST=127.0.0.1
+Environment=DEVICE_EDGE_RELAY_HEALTH_PORT=18221
+Environment=DEVICE_EDGE_RELAY_INGRESS_ENABLED=true
+Environment=DEVICE_EDGE_RELAY_TCP_HOST=0.0.0.0
+Environment=DEVICE_EDGE_RELAY_TCP_PORT=9921
+Environment=DEVICE_EDGE_RELAY_UPSTREAM_HOST=127.0.0.1
+Environment=DEVICE_EDGE_RELAY_UPSTREAM_PORT=19921
+Environment=DEVICE_EDGE_RELAY_MAX_SESSIONS=128
+Environment=DEVICE_EDGE_RELAY_MAX_SESSIONS_PER_ADDRESS=16
+Environment=DEVICE_EDGE_RELAY_MAX_CONNECTIONS_PER_MINUTE_PER_ADDRESS=60
+Environment=DEVICE_EDGE_RELAY_MAX_TRACKED_SOURCE_ADDRESSES=4096
+Environment=DEVICE_EDGE_RELAY_MAX_BYTES_PER_DIRECTION=67108864
+Environment=DEVICE_EDGE_RELAY_SESSION_TIMEOUT_MS=300000
+Environment=DEVICE_EDGE_RELAY_SOURCE_POLICY=public-ipv4-only
+ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-relay/src/server.mjs
+Restart=always
+RestartSec=3s
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=no
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+MemoryMax=192M
+TasksMax=64
+LimitNOFILE=4096
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,36 @@
+[Unit]
+Description=NODE.DC B2 VPS private Tailscale transport
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=notify
+User=nodedc-edge
+Group=nodedc-edge
+RuntimeDirectory=nodedc-b2-vps
+RuntimeDirectoryMode=0750
+StateDirectory=nodedc-b2-vps/tailscale
+StateDirectoryMode=0700
+ExecStart=/opt/nodedc-b2-vps/runtime/tailscale/tailscaled --state=/var/lib/nodedc-b2-vps/tailscale/tailscaled.state --socket=/run/nodedc-b2-vps/tailscaled.sock --tun=userspace-networking --socks5-server=127.0.0.1:1055
+Restart=always
+RestartSec=3s
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=no
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+SystemCallArchitectures=native
+MemoryMax=160M
+TasksMax=96
+LimitNOFILE=8192
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,50 @@
+[Unit]
+Description=NODE.DC provider-neutral Device Edge Core channel
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=nodedc-channel
+Group=nodedc-channel
+ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs
+Environment=DEVICE_EDGE_CHANNEL_HOST=0.0.0.0
+Environment=DEVICE_EDGE_CHANNEL_PORT=443
+Environment=DEVICE_EDGE_CHANNEL_HEALTH_HOST=127.0.0.1
+Environment=DEVICE_EDGE_CHANNEL_HEALTH_PORT=18222
+Environment=DEVICE_EDGE_CHANNEL_CONFIG_FILE=/var/lib/nodedc-b2-vps/channel-trust/runtime.json
+Environment=DEVICE_EDGE_CHANNEL_KEY_FILE=/var/lib/nodedc-b2-vps/channel-trust/edge-private-key.pem
+Environment=DEVICE_EDGE_CHANNEL_CERTIFICATE_FILE=/var/lib/nodedc-b2-vps/channel-trust/edge-certificate.pem
+Environment=DEVICE_EDGE_CHANNEL_CORE_TRUST_FILE=/var/lib/nodedc-b2-vps/channel-trust/core-certificate.pem
+Restart=always
+RestartSec=2
+TimeoutStartSec=20
+TimeoutStopSec=15
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=no
+SystemCallArchitectures=native
+RestrictAddressFamilies=AF_INET AF_INET6
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+UMask=0077
+MemoryMax=128M
+MemorySwapMax=0
+CPUQuota=50%
+TasksMax=64
+LimitNOFILE=1024
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,62 @@
+[Unit]
+Description=NODE.DC provider-neutral Device Edge runtime
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=nodedc-channel
+Group=nodedc-channel
+ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/vps/edge-process/device-edge-runtime.mjs
+Environment=DEVICE_EDGE_CHANNEL_HOST=0.0.0.0
+Environment=DEVICE_EDGE_CHANNEL_PORT=443
+Environment=DEVICE_EDGE_CHANNEL_HEALTH_HOST=127.0.0.1
+Environment=DEVICE_EDGE_CHANNEL_HEALTH_PORT=18222
+Environment=DEVICE_EDGE_CHANNEL_CONFIG_FILE=/var/lib/nodedc-b2-vps/channel-trust/runtime.json
+Environment=DEVICE_EDGE_CHANNEL_KEY_FILE=/var/lib/nodedc-b2-vps/channel-trust/edge-private-key.pem
+Environment=DEVICE_EDGE_CHANNEL_CERTIFICATE_FILE=/var/lib/nodedc-b2-vps/channel-trust/edge-certificate.pem
+Environment=DEVICE_EDGE_CHANNEL_CORE_TRUST_FILE=/var/lib/nodedc-b2-vps/channel-trust/core-certificate.pem
+Environment=DEVICE_GATEWAY_PROTOCOL_PROFILE_REF=arusnavi.b2.internal.v1
+Environment=DEVICE_GATEWAY_HEALTH_HOST=127.0.0.1
+Environment=DEVICE_GATEWAY_HEALTH_PORT=18221
+Environment=DEVICE_GATEWAY_TCP_HOST=0.0.0.0
+Environment=DEVICE_GATEWAY_TCP_PORT=9921
+Environment=DEVICE_GATEWAY_MAX_BUFFERED_BYTES=65536
+Environment=DEVICE_GATEWAY_MAX_AGGREGATE_BUFFERED_BYTES=33554432
+Environment=DEVICE_GATEWAY_MAX_SESSIONS=128
+Environment=DEVICE_GATEWAY_MAX_SESSIONS_PER_ADDRESS=16
+Environment=DEVICE_GATEWAY_MAX_CONNECTIONS_PER_MINUTE_PER_ADDRESS=60
+Environment=DEVICE_GATEWAY_MAX_TRACKED_SOURCE_ADDRESSES=2048
+Environment=DEVICE_GATEWAY_SESSION_TIMEOUT_MS=10000
+Restart=always
+RestartSec=2
+TimeoutStartSec=20
+TimeoutStopSec=15
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=no
+SystemCallArchitectures=native
+RestrictAddressFamilies=AF_INET AF_INET6
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+UMask=0077
+MemoryMax=192M
+MemorySwapMax=0
+CPUQuota=75%
+TasksMax=128
+LimitNOFILE=1024
+
+[Install]
+WantedBy=multi-user.target