Skip to content

fix(launch): route systemd + demo bind through the SEC-F22 guard (SEC-F23/F24) #433

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pcalnon merged 1 commit into from
Jul 7, 2026
Merged

fix(launch): route systemd + demo bind through the SEC-F22 guard (SEC-F23/F24) #433

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion scripts/juniper-canopy.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,18 @@ Wants=network-online.target
Type=simple
WorkingDirectory=%h/Development/python/Juniper/juniper-canopy/src
EnvironmentFile=-%h/Development/python/Juniper/juniper-canopy/.env
ExecStart=/opt/miniforge3/envs/JuniperCanopy/bin/python -m uvicorn main:app --host 0.0.0.0 --port 8050
# Bind host/port come from settings (JUNIPER_CANOPY_SERVER__HOST, default 127.0.0.1 loopback;
# JUNIPER_CANOPY_SERVER__PORT, default 8050). The SEC-F22 bind guard evaluates the setting at
# startup, so the bind MUST be driven through settings -- a `uvicorn --host` CLI flag would
# bypass the guard (uvicorn binds the socket without the setting ever being consulted, so the
# guard sees the loopback default and passes while the socket is public). See juniper-ml
# notes/JUNIPER_2026-07-06_JUNIPER-ECOSYSTEM_LAUNCH-PATH-BIND-AUDIT.md (SEC-F23).
# To expose off-loopback you MUST attest the perimeter; the guard hard-fails on an unattested
# non-loopback bind. Uncomment the host override AND exactly one honest attestation:
# Environment=JUNIPER_CANOPY_SERVER__HOST=0.0.0.0
# Environment=JUNIPER_CANOPY_LOOPBACK_PUBLISH_ATTESTED=true # only if reachable solely via a loopback-only host publish
# Environment=JUNIPER_CANOPY_AUTH_PROXY_ATTESTED=true # only if a fronting authenticating proxy terminates access
ExecStart=/opt/miniforge3/envs/JuniperCanopy/bin/python main.py
Restart=on-failure
RestartSec=5

Expand Down
11 changes: 10 additions & 1 deletion util/juniper_canopy-demo.bash
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,6 +267,15 @@ log_debug "Run using uvicorn for proper ASGI server support & Launch using exec
if [ -n "${JUNIPER_DATA_PID:-}" ]; then
trap 'kill "${JUNIPER_DATA_PID}" 2>/dev/null' EXIT
fi
exec "$CONDA_PREFIX/bin/uvicorn" main:app --host 0.0.0.0 --port 8050 --log-level info
# Bind host/port are driven through settings (JUNIPER_CANOPY_SERVER__HOST default 127.0.0.1
# loopback, JUNIPER_CANOPY_SERVER__PORT default 8050) so the SEC-F22 bind guard evaluates the
# real bind; a `uvicorn --host` CLI flag would bypass the guard. The demo binds loopback by
# default -- browse http://localhost:8050/dashboard/ on this machine. To expose the demo on
# your network you MUST attest the perimeter (the guard hard-fails on an unattested non-loopback
# bind); see juniper-ml notes/JUNIPER_2026-07-06_JUNIPER-ECOSYSTEM_LAUNCH-PATH-BIND-AUDIT.md:
# export JUNIPER_CANOPY_SERVER__HOST=0.0.0.0
# export JUNIPER_CANOPY_LOOPBACK_PUBLISH_ATTESTED=true # ONLY if fronted by a loopback-only host publish
# # or JUNIPER_CANOPY_AUTH_PROXY_ATTESTED=true # ONLY if a fronting authenticating proxy is deployed
exec "$CONDA_PREFIX/bin/python" main.py

exit $(( TRUE ))
Loading