morphit/ops/systemd/morphit-first-online.service

45 lines
2.1 KiB
Desktop File

# ─────────────────────────────────────────────────────────────────────
# Morphit — first-online deferred-completion service.
#
# Runs the network-dependent tail of the install (real TLS certificate,
# Blurt RPC connect, opt-in on-chain registration) the FIRST time this
# box sees a real internet connection, then the script retires its own
# timer. This is what lets Morphit be installed completely offline and
# still finish itself, unattended, whenever connectivity finally appears.
#
# Driven two ways for resilience:
# - WantedBy=network-online.target here → fires immediately at boot /
# when the network comes up.
# - morphit-first-online.timer (next file over) → retries every few
# minutes forever, covering connectivity that arrives late or flaps.
# The script is idempotent and gated on a REAL reachability probe, so
# firing from both sources (or repeatedly) is harmless.
#
# Why root:
# - It runs certbot (writes /etc/letsencrypt), restarts the indexer /
# relay units, reloads BunkerWeb via the docker socket, and disables
# its own timer. Those need root; this is a trusted, package-shipped
# completion script, not attacker-reachable input.
# ─────────────────────────────────────────────────────────────────────
[Unit]
Description=Morphit first-online deferred install completion (TLS + RPC + register)
Documentation=file:///opt/morphit/docs/RUN-A-MORPHIT-NODE.md
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/local/lib/morphit/morphit-first-online.sh
# Broad access is required (certbot, systemctl, docker); keep only the
# hardening that does not break those.
NoNewPrivileges=true
LockPersonality=true
RestrictRealtime=true
ProtectKernelModules=true
Restart=no
TimeoutStartSec=600
SyslogIdentifier=morphit-first-online
[Install]
WantedBy=network-online.target