carlos / platform Public

Download this file

1	# The db-read worker's socket (db region forward spec §8.3). Bound by root
2	# systemd and owned by carlos, so the agent connects with no privilege of
3	# its own. Each connection starts one carlos-dbread@ instance with the
4	# connection as its stdin and stdout. Three connections at most: two reads
5	# and the readiness probe (spec §7.1).
6	#
7	# It lives under /run/carlos because every tenant unit hides that tree
8	# (TemporaryFileSystem=/run/carlos:ro): tenants run as carlos too, the one
9	# uid the worker serves, so they must not be able to see this path. Only
10	# ensureSystemUnits arms it, and only on a box whose host.env arms db reads;
11	# elsewhere nothing listens (Astra round 1, finding 1).
12	[Unit]
13	Description=carlos db-read worker socket
14
15	[Socket]
16	ListenStream=/run/carlos/dbread/worker.sock
17	SocketUser=carlos
18	SocketGroup=carlos
19	SocketMode=0600
20	Accept=yes
21	MaxConnections=3
22
23	[Install]
24	WantedBy=sockets.target
25