fix(device-edge): use compatible Node hardening

2026-08-12 01:23:38 +03:00
parent 6fa9164933
commit 2eb6116880
4 changed files with 13 additions and 5 deletions
@@ -262,7 +262,8 @@ async function assertBoundary() {
      "\"runtimeUser\": \"nodedc-channel\"",
      "\"trackerIngress\": \"disabled\"",
      "User=nodedc-channel",
-      "node --jitless",
+      "ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs",
+      "MemoryDenyWriteExecute=no",
      "tcp dport 8443",
      "MemoryMax=128M",
      "MemorySwapMax=0",
@@ -279,6 +280,7 @@ async function assertBoundary() {
      "LocalForward",
      "tailscale-userspace",
      "DEVICE_EDGE_RELAY_UPSTREAM",
+      "--jitless",
    ]) {
      if (combined.includes(forbidden)) {
        throw new Error(`core_channel_boundary_violation:${forbidden}`);