carlos / platform Public

Download this file

1	# The db-read worker (db region forward spec §8.3): one instance per
2	# connection to carlos-dbread.socket. It writes one forwarded read's planned
3	# LTX files into its own private /var/tmp, restores them, checks the copy,
4	# and runs the member's one read-only statement. Everything that decodes
5	# tenant bytes runs here, as a DynamicUser with no network; the agent only
6	# moves bytes. systemd removes /tmp and /var/tmp when the unit stops,
7	# however it stops.
8	#
9	# StandardInput/StandardOutput=socket: with Accept=yes systemd passes the
10	# connection as a descriptor and puts it on stdin only when told to. The
11	# claim-bound template's StandardOutput=file: line is deliberately absent.
12	#
13	# LimitFSIZE is the default restored-size cap (CARLOS_DB_READ_MAX_BYTES,
14	# 2 GiB). A box that raises the cap needs a drop-in raising this too.
15	[Unit]
16	Description=carlos db-read worker
17
18	[Service]
19	ExecStart=/opt/carlos/carlos system db-worker
20	StandardInput=socket
21	StandardOutput=socket
22	StandardError=journal
23	DynamicUser=yes
24	PrivateNetwork=yes
25	RestrictAddressFamilies=AF_UNIX
26	TemporaryFileSystem=/data:ro /var/lib:ro /opt/carlos:ro /run/carlos:ro
27	BindReadOnlyPaths=/opt/carlos/carlos
28	InaccessiblePaths=/etc/carlos -/run/carlos-control
29	PrivateTmp=yes
30	ProtectSystem=strict
31	ProtectHome=yes
32	PrivateDevices=yes
33	ProtectProc=invisible
34	ProcSubset=pid
35	ProtectKernelTunables=yes
36	ProtectKernelModules=yes
37	ProtectKernelLogs=yes
38	ProtectClock=yes
39	ProtectHostname=yes
40	ProtectControlGroups=yes
41	RemoveIPC=yes
42	LockPersonality=yes
43	RestrictRealtime=yes
44	RestrictNamespaces=yes
45	RestrictSUIDSGID=yes
46	NoNewPrivileges=yes
47	CapabilityBoundingSet=
48	SystemCallFilter=@system-service
49	SystemCallArchitectures=native
50	MemoryDenyWriteExecute=yes
51	MemoryMax=512M
52	CPUQuota=100%
53	TasksMax=16
54	LimitFSIZE=2147483648
55	RuntimeMaxSec=20min
56