Download this file
| 1 | # Root's half of joining (region HA spec 2 §5 step 5.3): `carlos system |
| 2 | # join` verifies this box's signed invitation, writes the enrollment it |
| 3 | # names, and arms the host lifecycle guard (guard-arm) with the release |
| 4 | # identity `carlos system install-channel` kept. On a box that is armed |
| 5 | # already, has no invitation yet, or has CARLOS_HOST_CLAIM or |
| 6 | # CARLOS_REGION_HA off, it does nothing. Started only by |
| 7 | # carlos-system-join.path; no [Install] section, because nothing else |
| 8 | # should want it. |
| 9 | # |
| 10 | # Root, with no filesystem sandboxing, like carlos-system-update.service: |
| 11 | # guard-arm writes /opt/carlos/system/guard, /etc/carlos/host-actor.json and |
| 12 | # the guarded units' drop-ins under /etc/systemd/system. |
| 13 | # StartLimitIntervalSec=0 because the path unit can fire in bursts. |
| 14 | [Unit] |
| 15 | Description=carlos joining (root: arm the host lifecycle guard) |
| 16 | After=network-online.target |
| 17 | Wants=network-online.target |
| 18 | StartLimitIntervalSec=0 |
| 19 | |
| 20 | [Service] |
| 21 | Type=oneshot |
| 22 | TimeoutStartSec=5min |
| 23 | EnvironmentFile=-/etc/carlos/host.env |
| 24 | ExecStart=/opt/carlos/carlos system join |
| 25 | |
| 26 | # --- hardening (the carlos-system-update.service set) --- |
| 27 | ProtectHome=yes |
| 28 | PrivateTmp=yes |
| 29 | PrivateDevices=yes |
| 30 | ProtectClock=yes |
| 31 | ProtectHostname=yes |
| 32 | ProtectKernelTunables=yes |
| 33 | ProtectKernelModules=yes |
| 34 | ProtectKernelLogs=yes |
| 35 | RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX |
| 36 | RestrictNamespaces=yes |
| 37 | RestrictRealtime=yes |
| 38 | LockPersonality=yes |
| 39 | MemoryDenyWriteExecute=yes |
| 40 | MemoryMax=256M |
| 41 | TasksMax=64 |
| 42 | |
amadan