15 lines
1.2 KiB
Plaintext
15 lines
1.2 KiB
Plaintext
# Non-secret activation template for a verified immutable model-api package.
|
|
# Install only through the governed runtime activation procedure.
|
|
[Service]
|
|
Environment=AIOS_GITOPS_WORKSPACE=/opt/aios/gitops-model-api/<VERIFIED_PACKAGE_OID>/runtime
|
|
Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_ENABLED=true
|
|
Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_SOCKET=/run/aios-trusted-candidate-builder.sock
|
|
Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_POLICY=/opt/aios/gitops-model-api/<VERIFIED_PACKAGE_OID>/runtime/config/gitops/trusted-candidate-builder-policy.json
|
|
Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_PUBLIC_KEYRING=/etc/aios-gitops/trusted-builder/public-keyring.json
|
|
Environment=AIOS_TRUSTED_CANDIDATE_BUILDER_CREDENTIALS_DIRECTORY=%d
|
|
Environment=AIOS_SILENT_RELEASE_TRUSTED_POLICY=/opt/aios/gitops-model-api/<VERIFIED_PACKAGE_OID>/runtime/config/gitops/trusted-release-policy.json
|
|
LoadCredential=builder_hmac:/etc/aios-gitops/credential-references/trusted-candidate-builder-hmac
|
|
# The credential source above is a reference only; no secret value belongs here.
|
|
# Keep execution shadow-disabled and do not add Owner/deploy/tag/baseline switches.
|
|
Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
|