42 lines
1.3 KiB
Desktop File
42 lines
1.3 KiB
Desktop File
[Unit]
|
|
Description=AIOS disabled-by-default HTTPS edge for GPT read-only Online Task ingress
|
|
After=network-online.target aios-gpt-online-task-ingress.service
|
|
Wants=network-online.target aios-gpt-online-task-ingress.service
|
|
ConditionPathExists=/etc/aios-gitops/gpt-https-edge.approved
|
|
|
|
[Service]
|
|
Type=simple
|
|
DynamicUser=yes
|
|
LoadCredential=tls_cert:/etc/aios-gitops/gpt-https-edge-tls.crt
|
|
LoadCredential=tls_key:/etc/aios-gitops/gpt-https-edge-tls.key
|
|
Environment=AIOS_GPT_EDGE_TLS_CERT_FILE=%d/tls_cert
|
|
Environment=AIOS_GPT_EDGE_TLS_KEY_FILE=%d/tls_key
|
|
Environment=AIOS_GPT_EDGE_HOST=127.0.0.1
|
|
Environment=AIOS_GPT_EDGE_PORT=18443
|
|
Environment=AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED=0
|
|
Environment=AIOS_GPT_EDGE_PUBLIC_DOMAIN=
|
|
ExecStart=/usr/bin/python3 -B /opt/aios/current/active-runtime/app/aios_gpt_https_edge.py
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectClock=yes
|
|
LockPersonality=yes
|
|
RestrictSUIDSGID=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
InaccessiblePaths=/data/aios-gitops /etc/aios-gitops /home /var/lib/aios-agent-task
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|