diff options
| author | skylar <me@casper> | 2026-11-01 05:43:24 -0800 |
|---|---|---|
| committer | skylar <me@casper> | 2026-11-01 05:43:24 -0800 |
| commit | e69ad01e700e80fa959dfee08cd556ca0d777ffd (patch) | |
| tree | 645fc9db2142e87a5ef302733a77ba2fec848d88 /deploy/yesod.service | |
Yesod: self-hosted WebXR rooms
Start a room in a world and hang out in VR from the headset's browser:
A-Frame + Networked-A-Frame over EasyRTC, with a coturn relay that can hide
everyone's IP address. Ships with the Campfire, Temple, Cabin, Balcony and
Test room worlds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'deploy/yesod.service')
| -rw-r--r-- | deploy/yesod.service | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/deploy/yesod.service b/deploy/yesod.service new file mode 100644 index 0000000..6065a48 --- /dev/null +++ b/deploy/yesod.service @@ -0,0 +1,37 @@ +[Unit] +Description=Yesod WebXR rooms (Networked-A-Frame + EasyRTC signaling) +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +User=yesod +Group=yesod +WorkingDirectory=/opt/yesod +EnvironmentFile=/etc/yesod/env +ExecStart=/usr/bin/node server.js +Restart=on-failure +RestartSec=3 + +# Hardening: the app only needs to read its own files and listen on localhost. +NoNewPrivileges=yes +ProtectSystem=strict +ProtectHome=yes +PrivateTmp=yes +PrivateDevices=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectKernelLogs=yes +ProtectControlGroups=yes +ProtectClock=yes +ProtectHostname=yes +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +LockPersonality=yes +CapabilityBoundingSet= +SystemCallArchitectures=native +MemoryMax=300M + +[Install] +WantedBy=multi-user.target |