[Unit]
Description=AIOS governed approved production release executor
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=root
Group=root
UMask=0077
Environment=PYTHONDONTWRITEBYTECODE=1
Environment=AIOS_GITOPS_WRITES_ENABLED=false
EnvironmentFile=/etc/aios-gitops/approved-release-executor.env
ExecStart=/usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/approved_release_executor.py \
  --authorization ${AIOS_RELEASE_AUTHORIZATION} \
  --repository ${AIOS_GITOPS_AUTHORITATIVE_GIT_DIR} \
  --state-root ${AIOS_RELEASE_EXECUTION_STATE_ROOT} \
  --artifact ${AIOS_RELEASE_ARTIFACT} \
  --artifact-size ${AIOS_RELEASE_ARTIFACT_SIZE} \
  --version ${AIOS_RELEASE_VERSION} \
  --target-oid ${AIOS_RELEASE_TARGET_OID} \
  --evidence-closure-oid ${AIOS_RELEASE_EVIDENCE_CLOSURE_OID} \
  --artifact-sha256 ${AIOS_RELEASE_ARTIFACT_SHA256} \
  --approval-plan-id ${AIOS_RELEASE_APPROVAL_PLAN_ID} \
  --production-service aios-v2r1c7-production.service \
  --production-port 18927 \
  --tag-adapter /usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/governed_tag_adapter.py \
  --deploy-adapter /usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/v2r1c7_production_adapter.py \
  --registry-adapter /usr/bin/env AIOS_RELEASE_METADATA_MODE=registry /usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/release_metadata_adapter.py \
  --baseline-adapter /usr/bin/env AIOS_RELEASE_METADATA_MODE=baseline /usr/bin/python3 /usr/libexec/aios-approved-release-executor/current/active-runtime/app/release_metadata_adapter.py
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=full
ReadWritePaths=/etc/aios /etc/systemd/system /opt/aios /var/lib/aios /var/lib/aios-gitops /var/lib/aios-gitops-runtime-anchor /data/aios-gitops

[Install]
WantedBy=multi-user.target