Download this file
| 1 | # One release-adoption pass (release.Pass): resolve channel pointers, verify |
| 2 | # signatures, stage new versions under /opt/carlos/versions, repoint live |
| 3 | # symlinks, cycle systemd-managed routes. Fired hourly by carlos-adopt.timer. |
| 4 | # The agent also runs an in-process adopt loop, but that loop lives inside the |
| 5 | # sandboxed edge unit (ProtectSystem=strict, no /opt write) — this root oneshot |
| 6 | # is what actually stages on a hardened box. Shaped after Eleven's |
| 7 | # deploy/systemd/lchat-update.service. |
| 8 | [Unit] |
| 9 | Description=carlos adopt (one release-adoption pass) |
| 10 | After=network-online.target |
| 11 | Wants=network-online.target |
| 12 | |
| 13 | [Service] |
| 14 | Type=oneshot |
| 15 | # CARLOS_DEPLOYMENT_BUCKET/_DIR + CARLOS_RELEASE_PUBKEY live here. |
| 16 | EnvironmentFile=-/etc/carlos/host.env |
| 17 | ExecStart=/opt/carlos/carlos adopt |
| 18 | |
| 19 | # --- hardening --- |
| 20 | # Runs as ROOT deliberately (like Eleven's updater): a pass writes the version |
| 21 | # store (/opt/carlos) and restarts instance units via systemctl. NoNewPrivileges |
| 22 | # and the syscall filter are omitted for the systemctl child; the rest applies. |
| 23 | ProtectHome=yes |
| 24 | PrivateTmp=yes |
| 25 | PrivateDevices=yes |
| 26 | ProtectClock=yes |
| 27 | ProtectHostname=yes |
| 28 | ProtectKernelTunables=yes |
| 29 | ProtectKernelModules=yes |
| 30 | ProtectKernelLogs=yes |
| 31 | RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX |
| 32 | RestrictNamespaces=yes |
| 33 | RestrictRealtime=yes |
| 34 | LockPersonality=yes |
| 35 | MemoryDenyWriteExecute=yes |
| 36 | MemoryMax=256M |
| 37 | TasksMax=64 |
| 38 | |
amadan