2026-11-01 02:33:02 +01:00
|
|
|
[Unit]
|
|
|
|
|
Description=Idunn steward orders: typed package, unit and deploy orders from the steward
|
|
|
|
|
# Deliberately no After= or Requires= on any managed target, Synapse or
|
|
|
|
|
# idunn-yggdrasil: orders are how an operator repairs those, so none of them
|
|
|
|
|
# may be a condition of this unit starting. Posts are a retried projection and
|
|
|
|
|
# wait for Synapse on their own.
|
|
|
|
|
|
|
|
|
|
[Service]
|
|
|
|
|
Type=simple
|
|
|
|
|
|
|
|
|
|
# Root, from the same binary as idunn-yggdrasil, with its own store and socket.
|
|
|
|
|
# idunn-yggdrasil keeps its no-imperative-input invariant and its write set:
|
|
|
|
|
# no order code runs in `idunn serve`.
|
|
|
|
|
#
|
|
|
|
|
# The unit name matches idunn-*, which is in the always-refused set, so no
|
|
|
|
|
# order can stop or restart this service.
|
|
|
|
|
User=root
|
Steward orders: one steward gate for fresh and recovered orders; the orders unit leaks no group or umask; root reads; kernel-attested issuer; end-to-end serve test
execute refuses, with a record and a post, an order whose principal or issuing
uid is not the steward bound now, before grammar, scope and brake; the brake
is asked for the bound principal only. idunn-orders.service drops Group= and
UMask=: bind_socket gives the socket to the steward uid at 0600 and serve sets
Idunn's own umask, so a deploy order writes control.cc 0640. Root may show and
list, never order. The issuer unit is the first unit under system.slice, never
a name the peer chose below it. Synapse waits for a reply within one deadline.
due_posts takes the deploy-state reader so a finished deploy's post is tested.
Tests: the gate both ways, root, per-order posts, deploy result, intake and
Synapse timeouts, parse_serve, user_uid, socket and store modes, and the whole
service as root with a fake systemctl, systemd-run and homeserver.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-01 05:03:17 +01:00
|
|
|
# No Group= and no UMask=: the service gives its socket to the steward user
|
|
|
|
|
# (mode 0600) itself and sets Idunn's own umask for the files it writes, so
|
|
|
|
|
# nothing here reaches control.cc. The steward user is the only peer the
|
|
|
|
|
# service answers: it checks SO_PEERCRED on every connection.
|
2026-11-01 02:33:02 +01:00
|
|
|
ExecStart=/usr/local/bin/idunn orders serve \
|
|
|
|
|
--store /var/lib/gamecult/idunn-orders \
|
|
|
|
|
--state-store /var/lib/gamecult/idunn/control.cc \
|
|
|
|
|
--steward-binding /etc/gamecult/idunn/steward.toml \
|
|
|
|
|
--socket /run/idunn-orders/steward.sock
|
|
|
|
|
Restart=always
|
|
|
|
|
RestartSec=5
|
|
|
|
|
TimeoutStopSec=20
|
|
|
|
|
|
|
|
|
|
RuntimeDirectory=idunn-orders
|
Steward orders: one steward gate for fresh and recovered orders; the orders unit leaks no group or umask; root reads; kernel-attested issuer; end-to-end serve test
execute refuses, with a record and a post, an order whose principal or issuing
uid is not the steward bound now, before grammar, scope and brake; the brake
is asked for the bound principal only. idunn-orders.service drops Group= and
UMask=: bind_socket gives the socket to the steward uid at 0600 and serve sets
Idunn's own umask, so a deploy order writes control.cc 0640. Root may show and
list, never order. The issuer unit is the first unit under system.slice, never
a name the peer chose below it. Synapse waits for a reply within one deadline.
due_posts takes the deploy-state reader so a finished deploy's post is tested.
Tests: the gate both ways, root, per-order posts, deploy result, intake and
Synapse timeouts, parse_serve, user_uid, socket and store modes, and the whole
service as root with a fake systemctl, systemd-run and homeserver.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-01 05:03:17 +01:00
|
|
|
RuntimeDirectoryMode=0755
|
2026-11-01 02:33:02 +01:00
|
|
|
|
|
|
|
|
# The Synapse access token of @idunn, copied from a root-only file, and read
|
|
|
|
|
# through $CREDENTIALS_DIRECTORY; the service names it in steward.toml.
|
|
|
|
|
LoadCredential=idunn-matrix-token:/etc/gamecult/idunn/matrix-token
|
|
|
|
|
|
|
|
|
|
PrivateTmp=yes
|
|
|
|
|
ProtectHome=yes
|
|
|
|
|
ProtectSystem=strict
|
|
|
|
|
# Its own order store, and the control store a deploy order commits a command
|
|
|
|
|
# to. Transient units started with systemd-run run in the manager's namespace,
|
|
|
|
|
# so packages and units are not limited by this list.
|
|
|
|
|
ReadWritePaths=/var/lib/gamecult/idunn-orders /var/lib/gamecult/idunn
|
|
|
|
|
|
|
|
|
|
[Install]
|
|
|
|
|
WantedBy=multi-user.target
|