48 lines
1.7 KiB
Desktop File
48 lines
1.7 KiB
Desktop File
[Unit]
|
|
Description=AIOS durable Owner authorization broker
|
|
After=network.target aios-chatgpt-bridge-v2-staging.service
|
|
Wants=aios-chatgpt-bridge-v2-staging.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
Group=aios-executor-exchange
|
|
RuntimeDirectory=aios-owner-authorization-broker
|
|
RuntimeDirectoryMode=0750
|
|
StateDirectory=aios-owner-authorization-broker
|
|
StateDirectoryMode=0750
|
|
LoadCredential=agent_task_control_token:/etc/aios-gitops/agent-task-control.token
|
|
Environment=AIOS_AGENT_TASK_CONTROL_TOKEN_FILE=%d/agent_task_control_token
|
|
Environment=AIOS_OWNER_DURABLE_AUTHORIZATION_POLICY=/etc/aios-gitops/owner-durable-authorization.json
|
|
Environment=AIOS_OWNER_DURABLE_AUTHORIZATION_REVOCATIONS=/etc/aios-gitops/owner-durable-authorization-revocations.json
|
|
Environment=AIOS_OWNER_AUTH_BROKER_ACCOUNT=chatgpt-governed-implementer-singlehost
|
|
Environment=AIOS_OWNER_AUTH_BROKER_SOCKET=%t/aios-owner-authorization-broker/broker.sock
|
|
ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_durable_owner_authorization.py
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectClock=yes
|
|
LockPersonality=yes
|
|
RestrictSUIDSGID=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET
|
|
IPAddressDeny=any
|
|
IPAddressAllow=127.0.0.0/8
|
|
ReadOnlyPaths=/etc/aios-gitops/owner-durable-authorization.json
|
|
ReadOnlyPaths=/etc/aios-gitops/owner-durable-authorization-revocations.json
|
|
InaccessiblePaths=/data/aios-gitops /home
|
|
UMask=0007
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|