From 7b455cd43149834ccd2163b4e5d197809bd34a37 Mon Sep 17 00:00:00 2001
From: Matthias Andreas Benkard <code@mail.matthias.benkard.de>
Date: Sun, 9 Aug 2026 08:33:37 +0200
Subject: Add a public web front end alongside the CLI

Extracts the CLI pipeline into a reusable Pipeline class and exposes it
via a dependency-free JDK HttpServer (upload form, bounded worker pool
with 503 on overload, per-request size/time limits, no persisted
uploads), plus nginx/systemd deploy templates and Impressum/Datenschutz
placeholders for public operation.

Change-Id: I6e8e7afa3c4b1082cdf9e82da0fae0b5b49470ad
---
 deploy/aendggner-web.service | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 deploy/aendggner-web.service

(limited to 'deploy/aendggner-web.service')

diff --git a/deploy/aendggner-web.service b/deploy/aendggner-web.service
new file mode 100644
index 0000000..f87bbb8
--- /dev/null
+++ b/deploy/aendggner-web.service
@@ -0,0 +1,41 @@
+# systemd-Unit für den ÄndGgner-Webserver.
+#
+# Installation (Beispiel):
+#   sudo cp deploy/aendggner-web.service /etc/systemd/system/
+#   sudo useradd --system --home /opt/aendggner --shell /usr/sbin/nologin aendggner
+#   sudo cp -r . /opt/aendggner && sudo chown -R aendggner:aendggner /opt/aendggner
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now aendggner-web
+#
+# Erwartet, dass zuvor "mvn package" gelaufen ist, sodass target/aendggner-*.jar
+# und target/libs/* existieren.
+
+[Unit]
+Description=AendGgner Web-App
+After=network.target
+
+[Service]
+Type=simple
+User=aendggner
+Group=aendggner
+WorkingDirectory=/opt/aendggner
+ExecStart=/bin/sh -c 'exec java -cp "target/aendggner-*.jar:target/libs/*" eu.mulk.aendggner.web.WebMain'
+Environment=AENDGGNER_WEB_PORT=8080
+Environment=AENDGGNER_WEB_BIND=127.0.0.1
+Restart=on-failure
+RestartSec=5
+
+# Ressourcen-Obergrenzen: hält den Dienst auf einem kleinen Server in Schach,
+# selbst wenn die Anwendungs- und Proxy-seitigen Limits einmal nicht greifen.
+MemoryMax=512M
+CPUQuota=150%
+TasksMax=128
+
+# Härtung
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.1