51 lines
1.7 KiB
Desktop File
51 lines
1.7 KiB
Desktop File
[Unit]
|
|
Description=AIOS release-candidate Online Agent worker
|
|
After=network.target aios-agent-task-api.service
|
|
Wants=aios-agent-task-api.service
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=main
|
|
WatchdogSec=90
|
|
User=root
|
|
Group=root
|
|
StateDirectory=aios-online-agent-release
|
|
StateDirectoryMode=0750
|
|
LoadCredentialEncrypted=agent_token:/etc/credstore.encrypted/aios-release-online-agent-worker/agent_token
|
|
LoadCredentialEncrypted=release_candidate_token:/etc/credstore.encrypted/aios-release-online-agent-worker/release_candidate_token
|
|
Environment=AIOS_RELEASE_WORKER_AGENT_ID=online-release-worker-cn-network-mkt-20260819
|
|
Environment=AIOS_RELEASE_WORKER_AGENT_VERSION=2026-08-19.1-release-candidate
|
|
Environment=AIOS_AGENT_TASK_API_URL=http://127.0.0.1:18940
|
|
Environment=AIOS_RELEASE_WORKER_STATE_ROOT=/var/lib/aios-online-agent-release
|
|
Environment=AIOS_WORKER_STATE_ROOT=/var/lib/aios-online-agent-release
|
|
Environment=AIOS_RELEASE_WORKER_POLL_SECONDS=3
|
|
Environment=AIOS_RELEASE_WORKER_LEASE_SECONDS=60
|
|
Environment=AIOS_RELEASE_WORKER_HEARTBEAT_SECONDS=15
|
|
Environment=AIOS_RELEASE_API_URL=http://127.0.0.1:18890
|
|
ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_release_online_agent_worker.py
|
|
Restart=always
|
|
RestartSec=2
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectClock=yes
|
|
LockPersonality=yes
|
|
RestrictSUIDSGID=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET
|
|
IPAddressDeny=any
|
|
IPAddressAllow=127.0.0.0/8
|
|
InaccessiblePaths=/data/aios-gitops /home
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|