35 lines
2.0 KiB
Plaintext
35 lines
2.0 KiB
Plaintext
# Template only. Deployment Agent must substitute non-secret, verified values.
|
|
# /etc/systemd/system/aios-gitops-model-api.service.d/45-owner-authorization-broker.conf
|
|
[Service]
|
|
Environment=AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED=true
|
|
Environment=AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT=/var/lib/aios-gitops/owner-authorization-broker
|
|
|
|
# Select exactly one scope already present on the intended non-wildcard Owner
|
|
# credential. This is only an authentication intake scope; it is not copied
|
|
# into the generated task-writer grant.
|
|
Environment=AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES=commit:create
|
|
|
|
# Required explicit Owner account allowlist. Replace with the verified account
|
|
# from the existing token registry; never put the bearer token here.
|
|
Environment=AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_IDENTITIES=REPLACE_WITH_OWNER_ACCOUNT
|
|
|
|
# If handler.need() does not return non-secret scope metadata, configure the
|
|
# exact non-secret credential ID instead. Leave empty when scope readback is
|
|
# available. Never put a token or token digest in this value.
|
|
Environment=AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_CREDENTIAL_IDS=
|
|
|
|
Environment=AIOS_GITOPS_OWNER_AUTHORIZATION_MAX_EXPIRY_SECONDS=900
|
|
Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
|
|
Environment=AIOS_GITOPS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
|
|
Environment=AIOS_GITOPS_AUTHORIZED_WRITER_STATE_ROOT=/var/lib/aios-gitops/authorized-writer-bridge
|
|
Environment=AIOS_GITOPS_GRANT_SIGNER_ADAPTER=/usr/local/libexec/aios-grant-signer-adapter
|
|
Environment=AIOS_GITOPS_GRANT_VALIDATOR=/usr/local/libexec/aios-grant-validator
|
|
Environment=AIOS_GITOPS_TASK_WRITER_PROVISIONER=/usr/local/libexec/aios-task-writer-provisioner
|
|
Environment=AIOS_GITOPS_GOVERNED_USE_SUDO=true
|
|
Environment=AIOS_GITOPS_SUDO_PATH=/usr/bin/sudo
|
|
|
|
# Replace the current Python entrypoint only after staging acceptance.
|
|
# This wrapper preserves existing routes and both bridge endpoints.
|
|
# ExecStart=
|
|
# ExecStart=/usr/bin/python3 /opt/aios/active-runtime/app/aios_owner_authorization_broker_api.py
|