| 1 | # One RESTART-REQUEST pass (`carlos restart`, issue #113): cycle the units of |
| 2 | # every app whose restart generation has moved since this box last acted, and |
| 3 | # nothing else. Started only by carlos-restart.path, which fires when the agent |
| 4 | # touches /data/restart-requested; it has no [Install] section because nothing |
| 5 | # else should ever want it. |
| 6 | # |
| 7 | # Deliberately NOT carlos-adopt.service: that unit also runs release.Pass, the |
| 8 | # capability converge and the canary-TTL nag, so pointing a per-request trigger |
| 9 | # at it would let one tenant's `carlos restart` cut over ANOTHER app's pending |
| 10 | # release within seconds, and would nag on every request instead of hourly — |
| 11 | # the same split carlos-config-sync.service and carlos-stage.service already |
| 12 | # make. Same root + hardening shape as those two, which is what `systemctl |
| 13 | # try-restart` requires. |
| 14 | # |
| 15 | # It needs neither CARLOS_RELEASE_PUBKEY nor CARLOS_SECRETS_KEY: a restart |
| 16 | # verifies no signature and renders no config. The EnvironmentFile is still |
| 17 | # read for CARLOS_DEPLOYMENT_BUCKET/_DIR, which is where the request itself is. |
| 18 | [Unit] |
| 19 | Description=carlos instance restart (on agent request) |
| 20 | After=network-online.target |
| 21 | Wants=network-online.target |
| 22 | # A path unit re-triggers as often as members ask; the default start rate limit |
| 23 | # would latch this unit into start-limit-hit after a burst and then ignore every |
| 24 | # later trigger until an operator reset it. ([Unit], not [Service] — systemd |
| 25 | # moved these two keys in v230.) |
| 26 | StartLimitIntervalSec=0 |
| 27 | |
| 28 | [Service] |
| 29 | Type=oneshot |
| 30 | # CARLOS_DEPLOYMENT_BUCKET/_DIR lives here. |
| 31 | EnvironmentFile=-/etc/carlos/host.env |
| 32 | ExecStart=/opt/carlos/carlos adopt -restart-only |
| 33 | |
| 34 | # --- hardening --- |
| 35 | # Runs as ROOT deliberately, exactly like carlos-adopt.service: this pass |
| 36 | # restarts carlos-app@ tenants and operator-named units via systemctl. |
| 37 | # NoNewPrivileges and the syscall filter are omitted for the systemctl child; |
| 38 | # the rest applies. |
| 39 | ProtectHome=yes |
| 40 | PrivateTmp=yes |
| 41 | PrivateDevices=yes |
| 42 | ProtectClock=yes |
| 43 | ProtectHostname=yes |
| 44 | ProtectKernelTunables=yes |
| 45 | ProtectKernelModules=yes |
| 46 | ProtectKernelLogs=yes |
| 47 | RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX |
| 48 | RestrictNamespaces=yes |
| 49 | RestrictRealtime=yes |
| 50 | LockPersonality=yes |
| 51 | MemoryDenyWriteExecute=yes |
| 52 | MemoryMax=256M |
| 53 | TasksMax=64 |
| 54 | |
amadan