# The line-speed test server on ep0 (R-1247; operator ruling 2026-10-24 07:26). A box's agent runs a 10-second
# upload test against it once a week, inside the WireGuard tunnel. Installed by hand on ep0 as
# /etc/systemd/system/felhom-iperf3.service; the firewall line that opens it is in README.md beside this file.
#
# Bound to the tunnel address only, TCP only (the nftables line admits TCP from wg0 10.77.0.0/24). Debian's own
# iperf3.service stays disabled. The caps bound the two open no-DSA server issues of iperf3 3.18 (CVE-2026-71217:
# oversized parameters exhaust memory and threads; CVE-2026-102253: a UDP worker spins — UDP never reaches it):
# MemoryMax/TasksMax/CPUQuota keep PBS safe, RuntimeMaxSec restarts a stuck server once a day.
[Unit]
Description=Felhom: iperf3 line-speed test server, tunnel only (R-1247)
Documentation=https://gitea.dooplex.hu/admin/felhom.eu/src/branch/main/scripts/ep0-iperf3/README.md
After=wg-quick@wg0.service
Wants=wg-quick@wg0.service

[Service]
Type=simple
ExecStart=/usr/bin/iperf3 --server --bind 10.77.0.1 --port 5201 --interval 0 --idle-timeout 120 --rcv-timeout 15000
SuccessExitStatus=1
Restart=always
RestartSec=10
RuntimeMaxSec=1d
DynamicUser=yes
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
MemoryMax=128M
TasksMax=16
CPUQuota=50%

[Install]
WantedBy=multi-user.target