core-agent-linux/vm-systemd/qubes-yum-proxy.service

[Unit]
Description=Qubes yum proxy (tinyproxy)
ConditionPathExists=/var/run/qubes-service/qubes-yum-proxy
After=iptables.service

[Service]
ExecStartPre=/usr/bin/install -d --owner tinyproxy --group tinyproxy /var/run/tinyproxy
ExecStartPre=/usr/lib/qubes/iptables-yum-proxy start
ExecStart=/usr/sbin/tinyproxy -d -c /etc/tinyproxy/tinyproxy-qubes-yum.conf
ExecStopPost=/usr/lib/qubes/iptables-yum-proxy stop
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target
vm: qubes-yum-proxy service (#568) Introduce proxy service, which allow only http(s) traffic to yum repos. The filter rules are based on URL regexp, so it isn't full-featured content inspection and can be easy bypassed, but should be enough to prevent some erroneus user actions (like clicking on invalid link). It is set up to intercept connections to 10.137.255.254:8082, so VM can connect to this IP regardless of VM in which proxy is running. By default it is started in every NetVM, but this can be changed using qvm-service or qubes-manager (as always). 2012-05-31 02:24:49 +02:00			`[Unit]`
			`Description=Qubes yum proxy (tinyproxy)`
			`ConditionPathExists=/var/run/qubes-service/qubes-yum-proxy`
			`After=iptables.service`

			`[Service]`
vm/qubes-yum-proxy: create dir for pidfile under FC15 (#568) On FC>=15 /var/run is on tmpfs, so /var/run/tinyproxy from rpm don't survive reboot. This is bug in Fedora package (should include config file for tmpfiles service). For now create dir just before starting service. 2012-05-31 02:33:56 +02:00			`ExecStartPre=/usr/bin/install -d --owner tinyproxy --group tinyproxy /var/run/tinyproxy`
yum-proxy: use iptables-restore to set firewall rules Simple iptables sometimes returns EBUSY. 2013-08-05 02:08:52 +02:00			`ExecStartPre=/usr/lib/qubes/iptables-yum-proxy start`
vm: qubes-yum-proxy service (#568) Introduce proxy service, which allow only http(s) traffic to yum repos. The filter rules are based on URL regexp, so it isn't full-featured content inspection and can be easy bypassed, but should be enough to prevent some erroneus user actions (like clicking on invalid link). It is set up to intercept connections to 10.137.255.254:8082, so VM can connect to this IP regardless of VM in which proxy is running. By default it is started in every NetVM, but this can be changed using qvm-service or qubes-manager (as always). 2012-05-31 02:24:49 +02:00			`ExecStart=/usr/sbin/tinyproxy -d -c /etc/tinyproxy/tinyproxy-qubes-yum.conf`
yum-proxy: use iptables-restore to set firewall rules Simple iptables sometimes returns EBUSY. 2013-08-05 02:08:52 +02:00			`ExecStopPost=/usr/lib/qubes/iptables-yum-proxy stop`
yum-proxy: automatically restart the service on failure 2014-02-21 13:30:07 +01:00			`Restart=on-failure`
			`RestartSec=5s`
vm: qubes-yum-proxy service (#568) Introduce proxy service, which allow only http(s) traffic to yum repos. The filter rules are based on URL regexp, so it isn't full-featured content inspection and can be easy bypassed, but should be enough to prevent some erroneus user actions (like clicking on invalid link). It is set up to intercept connections to 10.137.255.254:8082, so VM can connect to this IP regardless of VM in which proxy is running. By default it is started in every NetVM, but this can be changed using qvm-service or qubes-manager (as always). 2012-05-31 02:24:49 +02:00
			`[Install]`
			`WantedBy=multi-user.target`