Systemd Deployment¶

# Create directories
sudo mkdir -p /opt/bytefreezer/bin
sudo mkdir -p /etc/bytefreezer
sudo mkdir -p /var/spool/bytefreezer-proxy
sudo mkdir -p /var/cache/bytefreezer-proxy
sudo mkdir -p /var/log/bytefreezer

# Download latest release
curl -L https://github.com/bytefreezer/proxy/releases/latest/download/bytefreezer-proxy-linux-amd64 \
  -o /opt/bytefreezer/bin/bytefreezer-proxy

# Make executable
sudo chmod +x /opt/bytefreezer/bin/bytefreezer-proxy

sudo useradd -r -s /bin/false bytefreezer
sudo chown -R bytefreezer:bytefreezer /var/spool/bytefreezer-proxy
sudo chown -R bytefreezer:bytefreezer /var/cache/bytefreezer-proxy
sudo chown -R bytefreezer:bytefreezer /var/log/bytefreezer

app:
  name: bytefreezer-proxy

config_mode: "control-only"
account_id: "your-account-id"
bearer_token: "your-api-key"
control_url: "https://api.bytefreezer.com"

config_polling:
  enabled: true
  interval_seconds: 60
  cache_directory: "/var/cache/bytefreezer-proxy"

receiver:
  base_url: "http://your-receiver:8080"    # Your Receiver webhook endpoint

batching:
  enabled: true
  max_bytes: 10485760
  timeout_seconds: 60
  compression_enabled: true

spooling:
  enabled: true
  directory: "/var/spool/bytefreezer-proxy"
  max_size_bytes: 1073741824       # 1GB - queue/retry size limit
  dlq_max_size_bytes: 10737418240  # 10GB - DLQ hard limit, oldest removed first (FIFO)
  retry_attempts: 5
  retry_interval_seconds: 60
  cleanup_interval_seconds: 300

health_reporting:
  enabled: true
  report_interval: 30

logging:
  level: info
  encoding: console

sudo chown bytefreezer:bytefreezer /etc/bytefreezer/config.yml
sudo chmod 600 /etc/bytefreezer/config.yml   # Protect API key

[Unit]
Description=ByteFreezer Proxy
Documentation=https://docs.bytefreezer.com/proxy
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=bytefreezer
Group=bytefreezer

ExecStart=/opt/bytefreezer/bin/bytefreezer-proxy -config /etc/bytefreezer/config.yml

Restart=always
RestartSec=5

# Allow binding to privileged ports (< 1024)
AmbientCapabilities=CAP_NET_BIND_SERVICE

# Security hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/spool/bytefreezer-proxy /var/cache/bytefreezer-proxy /var/log/bytefreezer
PrivateTmp=yes

# Resource limits
LimitNOFILE=65536
LimitNPROC=4096

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable bytefreezer-proxy
sudo systemctl start bytefreezer-proxy

# Check status
sudo systemctl status bytefreezer-proxy

# View logs
sudo journalctl -u bytefreezer-proxy -f

# View last 100 lines
sudo journalctl -u bytefreezer-proxy -n 100

# Restart
sudo systemctl restart bytefreezer-proxy

# Stop
sudo systemctl stop bytefreezer-proxy

sudo firewall-cmd --permanent --add-port=514/udp    # Syslog
sudo firewall-cmd --permanent --add-port=514/tcp    # Syslog TCP
sudo firewall-cmd --permanent --add-port=6343/udp   # sFlow
sudo firewall-cmd --permanent --add-port=4739/udp   # IPFIX
sudo firewall-cmd --permanent --add-port=2055/udp   # NetFlow
sudo firewall-cmd --permanent --add-port=8008/tcp   # API
sudo firewall-cmd --reload

sudo ufw allow 514/udp    # Syslog
sudo ufw allow 514/tcp    # Syslog TCP
sudo ufw allow 6343/udp   # sFlow
sudo ufw allow 4739/udp   # IPFIX
sudo ufw allow 2055/udp   # NetFlow
sudo ufw allow 8008/tcp   # API

sudo iptables -A INPUT -p udp --dport 514 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 514 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 6343 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 4739 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 2055 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8008 -j ACCEPT

# Apply immediately
sudo sysctl -w net.core.rmem_max=16777216
sudo sysctl -w net.core.rmem_default=8388608
sudo sysctl -w net.core.netdev_max_backlog=50000

# Persist across reboots
cat <<EOF | sudo tee /etc/sysctl.d/99-bytefreezer.conf
net.core.rmem_max=16777216
net.core.rmem_default=8388608
net.core.netdev_max_backlog=50000
EOF

sudo sysctl --system

# Stop service
sudo systemctl stop bytefreezer-proxy

# Download new version
curl -L https://github.com/bytefreezer/proxy/releases/latest/download/bytefreezer-proxy-linux-amd64 \
  -o /opt/bytefreezer/bin/bytefreezer-proxy

sudo chmod +x /opt/bytefreezer/bin/bytefreezer-proxy

# Start service
sudo systemctl start bytefreezer-proxy

# Verify
sudo systemctl status bytefreezer-proxy

# Check for errors
sudo journalctl -u bytefreezer-proxy -n 50

# Verify config syntax
/opt/bytefreezer/bin/bytefreezer-proxy -config /etc/bytefreezer/config.yml -validate

# Find what's using the port
sudo ss -ulnp | grep :514
sudo lsof -i :514