AIOS Governance Automation
9303a5d684
aios/branch-protection task-scoped PASS evidence_sha256=9cda4ebf561ae96e3f2f21eb4d4b89541626026fe521d089b7d5ec6d4af80787
aios/evidence-closure task-scoped PASS evidence_sha256=2239bd1868318c50d4e3287ce94adb92c2d13759aa8ef01cfea97142ae8a94b4
aios/secret-scan task-scoped PASS evidence_sha256=4ae633ace2f93b4093545108b2511c35530f1f1e89058bbb2633151f5d166248
aios/state-machine task-scoped PASS evidence_sha256=ce63ce87cfdf0a17d4c1f0a0a68df1be8a48596c44e914fa8604ee3d05f8ead2
aios/validator task-scoped PASS evidence_sha256=469ef5a951db82e7d4b65554185cd337e5c4c6b9d8dcef92c4babec6d0ff9daf
24 lines
1.6 KiB
Desktop File
24 lines
1.6 KiB
Desktop File
[Unit]
|
|
Description=AIOS task credential expiry and completion sweeper
|
|
After=aios-gitea.service
|
|
Requires=aios-gitea.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=root
|
|
Group=root
|
|
ExecStart=/usr/bin/python3 -m aios_single_owner_governance.task_credential_expiry_sweeper --runtime-root /var/lib/aios-gitops/runtime/task-status-merge --allowed-signers /etc/aios-gitops/task-status-merge/allowed_signers
|
|
Environment=AIOS_GITOPS_WRITES_ENABLED=false
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadOnlyPaths=/etc/aios-gitops/task-status-merge/allowed_signers /data/aios-gitops/runtime/gitea-bin/data/actions_artifacts /data/aios-gitops/runtime/gitea-bin/data/actions_log /data/aios-gitops/runtime/gitea-bin/data/attachments /data/aios-gitops/runtime/gitea-bin/data/avatars /data/aios-gitops/runtime/gitea-bin/data/gitea.db.bak.20260708133830 /data/aios-gitops/runtime/gitea-bin/data/gitea.db.bak-20260710-0105 /data/aios-gitops/runtime/gitea-bin/data/home /data/aios-gitops/runtime/gitea-bin/data/indexers /data/aios-gitops/runtime/gitea-bin/data/jwt /data/aios-gitops/runtime/gitea-bin/data/packages /data/aios-gitops/runtime/gitea-bin/data/queues /data/aios-gitops/runtime/gitea-bin/data/repo-archive /data/aios-gitops/runtime/gitea-bin/data/repo-avatars /data/aios-gitops/runtime/gitea-bin/data/repositories /data/aios-gitops/runtime/gitea-bin/data/tmp
|
|
ReadWritePaths=/data/aios-gitops/runtime/gitea-bin/data /run/aios-task-credential-broker /var/lib/aios-gitops/runtime/task-status-merge
|
|
RestrictAddressFamilies=AF_UNIX AF_INET
|
|
IPAddressDeny=any
|
|
IPAddressAllow=localhost
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
RestrictSUIDSGID=true
|