morphit/ops/systemd/morphit-release-monitor.service

45 lines
1.4 KiB
Desktop File

[Unit]
Description=Morphit release monitor — check Forgejo for new releases
Documentation=https://git.agorise.net/agorise/morphit
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
# Reuse morphit-host-monitor's dedicated user — that sidecar is
# also network-touching and observation-only, so the privilege
# envelope is identical. No DB access needed.
User=morphit-host-monitor
Group=morphit-host-monitor
EnvironmentFile=-/etc/morphit/release-monitor.env
ExecStart=/opt/morphit/ops/scripts/morphit-release-monitor.sh
# ─── Hardening ─────────────────────────────────────────────────
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
LimitCORE=0
# Outbound HTTPS to git.agorise.net + DNS lookup.
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
# No filesystem writes needed — the sidecar only reads
# release-info.json and the ops-cli source tree, and emits
# its events to journald via the systemd-cat shim in emit.sh.
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
[Install]
WantedBy=multi-user.target