60 lines
2.8 KiB
Plaintext
60 lines
2.8 KiB
Plaintext
# Staging-only task identity overlay for V2R1C6 bootstrap.
|
|
# Install as /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
|
|
# after substituting the verified staging path.
|
|
[Unit]
|
|
Description=AIOS V2R1C6 task-scoped identity overlay
|
|
After=network.target
|
|
ConditionPathIsDirectory=/data/aios-gitops/repo.git
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
Group=root
|
|
WorkingDirectory=REPLACE_WITH_ROOT_OWNED_STAGING_DIR
|
|
Environment=PYTHONPATH=REPLACE_WITH_ROOT_OWNED_STAGING_DIR/active-runtime/app
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_ENABLED=true
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_HOST=127.0.0.1
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_PORT=19864
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_STATE_ROOT=/var/lib/aios-gitops/task-identity-overlays
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_SECRET_ROOT=/run/aios-gitops/task-identity-overlays
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_TASK_ID=V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_OWNER_IDENTITY=aiman
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_BASE_REF=refs/heads/main
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_BASE_OID=875d41c3101093149414292067fd700dc214d4d3
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_TARGET_BRANCH=agent/v2r1c6-mainline-reconciliation-20260805
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_MAX_TTL_SECONDS=900
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_REQUIRE_ROOT=true
|
|
# Agent must enumerate every active bearer secret reference discovered on-host.
|
|
Environment=AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS=REPLACE_WITH_COMMA_SEPARATED_ACTIVE_SECRET_REFS
|
|
Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
|
|
Environment=AIOS_GITOPS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
|
|
Environment=AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT=/var/lib/aios-gitops/owner-authorization-broker
|
|
Environment=AIOS_GITOPS_AUTHORIZED_WRITER_STATE_ROOT=/var/lib/aios-gitops/authorized-writer-bridge
|
|
Environment=AIOS_GITOPS_GRANT_SIGNER_ADAPTER=/usr/local/libexec/aios-grant-signer-adapter
|
|
Environment=AIOS_GITOPS_GRANT_VALIDATOR=/usr/local/libexec/aios-grant-validator
|
|
Environment=AIOS_GITOPS_TASK_WRITER_PROVISIONER=/usr/local/libexec/aios-task-writer-provisioner
|
|
Environment=AIOS_GITOPS_GOVERNED_USE_SUDO=false
|
|
ExecStart=/usr/bin/python3 REPLACE_WITH_ROOT_OWNED_STAGING_DIR/active-runtime/app/aios_task_identity_overlay_api.py
|
|
Restart=no
|
|
RuntimeDirectory=aios-gitops/task-identity-overlays
|
|
RuntimeDirectoryMode=0700
|
|
StateDirectory=aios-gitops/task-identity-overlays
|
|
StateDirectoryMode=0700
|
|
UMask=0077
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectHome=true
|
|
ProtectHostname=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
ProtectControlGroups=true
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
SystemCallArchitectures=native
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|