Пакет, systemd и proxy; сервер остаётся на loopback

usr/bin/gigastt
usr/lib/systemd/system/gigastt.service
etc/gigastt-pro/config.toml
etc/logrotate.d/gigastt
usr/share/gigastt-pro/domain_packs/
usr/share/gigastt-pro/INSTALL.txt
var/lib/gigastt/models/    # candle_int8/ при сборке --with-models, иначе пусто

[Unit]
Description=GigaSTT Pro — local Russian speech-to-text server
Documentation=https://gitverse.ru/ekhodzitsky/gigastt-pro
After=network.target

[Service]
Type=simple
User=gigastt
Group=gigastt
# --allow-insecure-bind: prefer reverse-proxy on loopback; when binding
# 0.0.0.0 without --auth-api-keys-file, this opt-in is required (or set keys).
# --offline is the binary default: no GitVerse/HTTP fetch from this process.
ExecStart=/usr/bin/gigastt serve --offline --model-dir /var/lib/gigastt/models --bind-all --host 0.0.0.0 --allow-insecure-bind
Restart=on-failure
RestartSec=5

# Logging: by default systemd captures stdout/stderr in journald.
# Uncomment the two lines below to write logs to /var/log/gigastt/gigastt.log
# instead (requires the logrotate config in /etc/logrotate.d/gigastt).
# StandardOutput=append:/var/log/gigastt/gigastt.log
# StandardError=append:/var/log/gigastt/gigastt.log

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/gigastt/models /var/log/gigastt
LogsDirectory=gigastt
StateDirectory=gigastt
PrivateTmp=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
# The server binds a >1024 port and needs no capabilities.
CapabilityBoundingSet=
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
# No public Internet. Clients and optional in-contour webhooks stay on
# loopback / RFC1918. Add extra prefixes if the site uses other private nets.
IPAddressDeny=any
IPAddressAllow=localhost
IPAddressAllow=10.0.0.0/8
IPAddressAllow=172.16.0.0/12
IPAddressAllow=192.168.0.0/16

# Resource limits
LimitNOFILE=65536
# No core dumps: audio and transcripts must not land on disk via a crash.
LimitCORE=0

[Install]
WantedBy=multi-user.target

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

location / {
    proxy_pass http://127.0.0.1:9876;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 600s;
}

# GigaSTT Pro — system-wide runtime configuration.
# The server loads this file automatically when it exists at
# /etc/gigastt-pro/config.toml and no --config flag is given.
# CLI flags and environment variables override values from this file.

# WebSocket idle timeout in seconds. Connection is closed when no frame
# arrives within this window.
idle_timeout_secs = 300

# Maximum WebSocket frame / message size in bytes.
ws_frame_max_bytes = 524288

# Maximum REST request body size in bytes.
body_limit_bytes = 52428800

# Per-IP rate limit: requests per minute. 0 disables the limiter.
rate_limit_per_minute = 0

# Token-bucket burst size for the rate limiter.
rate_limit_burst = 10

# Maximum wall-clock duration of a single WebSocket session in seconds.
max_session_secs = 3600

# Grace window after shutdown signal during which in-flight sessions may
# emit Final frames.
shutdown_drain_secs = 10

# How long REST / WebSocket handlers wait for a free session triplet
# before returning 503.
pool_checkout_timeout_secs = 30

# Per-request inference timeout in seconds. 0 disables.
inference_timeout_secs = 600

# Enable the asynchronous /v1/jobs API.
jobs_enabled = false

# TTL in seconds for finished/failed/cancelled jobs before eviction.
jobs_ttl_secs = 3600

# Maximum number of jobs kept in memory.
jobs_max = 100

# Maximum retry attempts for a job that hits inference_timeout or panics.
jobs_retry = 3

podman build -t gigastt-pro .
podman run -p 127.0.0.1:9876:9876 gigastt-pro