perf: batch gateway submits and isolate callbacks

tools/security/install-security-agent.sh

@@ -14,6 +14,8 @@ install -d -o root -g cmpp-security -m 0770 /run/cmpp-security-agent
 install -d -o root -g cmpp-security -m 0750 /var/lib/cmpp-security-agent
 install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/api"
 install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/send-worker"
+install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/submit-outbox"
+install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/gateway-callback"
 [[ -d /var/lib/cmpp-platform/object-storage ]] && chown -R cmpp-api:cmpp-security /var/lib/cmpp-platform/object-storage
 
 sed "s#@CMPP_SECURITY_AGENT_BIN@#$agent_binary#g" "$APP_DIR/deploy/security/cmpp-report-only.conf" >/etc/fail2ban/action.d/cmpp-report-only.conf
@@ -42,6 +44,29 @@ ProtectHome=true
 ProtectSystem=true
 ReadWritePaths=$APP_DIR/logs/send-worker /var/lib/cmpp-platform/object-storage
 EOF
+install -d -m 0755 /etc/systemd/system/cmpp-submit-outbox.service.d
+cat >/etc/systemd/system/cmpp-submit-outbox.service.d/security-boundary.conf <<EOF
+[Service]
+User=cmpp-api
+Group=cmpp-security
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=true
+ReadWritePaths=$APP_DIR/logs/submit-outbox
+EOF
+install -d -m 0755 /etc/systemd/system/cmpp-gateway-callback.service.d
+cat >/etc/systemd/system/cmpp-gateway-callback.service.d/security-boundary.conf <<EOF
+[Service]
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ReadWritePaths=$APP_DIR/logs/gateway-callback
+EOF
 grep -q 'cmpp-security.nft' /etc/nftables.conf || printf '\ninclude "/etc/nftables.d/cmpp-security.nft"\n' >>/etc/nftables.conf
 nft -c -f /etc/nftables.conf
 nft list table inet cmpp_security >/dev/null 2>&1 || nft -f /etc/nftables.d/cmpp-security.nft