coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add opt-in Railiance host time and private authority automation
All checks were successful
CI Smoke / source-contract (push) Successful in 16s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-15 21:59:29 +02:00
parent c402245207
commit 0d6cc3ec3b
13 changed files with 291 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
ansible/roles/railiance_clock/templates/authority.json.j2 Normal file
View file

@ -0,0 +1 @@
{{ {'private_key_file': railiance_clock_state_root + '/signing.pem', 'health_file': railiance_clock_health_root + '/health.json', 'health_owner_uid': 0, 'authority_id': 'railiance01', 'environment': 'prod', 'kid': railiance_clock_kid, 'policy_id': railiance_clock_policy_id, 'port': 8787, 'max_health_age_ns': 10000000000, 'host_drift_ppm': railiance_clock_host_drift_ppm | int, 'max_error_ns': railiance_clock_max_error_ns | int, 'max_continuity_error_ns': 50000000, 'max_sample_age_ns': 5000000000} | to_nice_json }}

1
ansible/roles/railiance_clock/templates/health-policy.json.j2 Normal file
View file

@ -0,0 +1 @@
{{ {'status': 'admitted', 'policy_id': railiance_clock_policy_id, 'upstreams': railiance_clock_upstreams, 'kernel_helper': railiance_clock_install_root + '/kernel-health', 'max_error_ns': railiance_clock_max_error_ns | int, 'measurement_margin_ns': railiance_clock_measurement_margin_ns | int, 'host_drift_ppm': railiance_clock_host_drift_ppm | int, 'admission_ref': railiance_clock_admission_ref} | to_nice_json }}

18
ansible/roles/railiance_clock/templates/railiance-clock-health.service.j2 Normal file
View file

@ -0,0 +1,18 @@
[Unit]
Description=Read-only Railiance host clock quality export
After=systemd-timesyncd.service
[Service]
Type=oneshot
ExecStart={{ railiance_clock_install_root }}/venv/bin/railiance-clock health-export --policy {{ railiance_clock_install_root }}/health-policy.json --output {{ railiance_clock_health_root }}/health.json
User=root
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
ProtectSystem=strict
ReadWritePaths={{ railiance_clock_health_root }}
ProtectHome=yes
PrivateTmp=yes
ProtectClock=yes
RestrictAddressFamilies=AF_UNIX
TimeoutStartSec=12
UMask=0022

9
ansible/roles/railiance_clock/templates/railiance-clock-health.timer.j2 Normal file
View file

@ -0,0 +1,9 @@
[Unit]
Description=Refresh Railiance host clock health
[Timer]
OnBootSec=2
OnUnitActiveSec=2
AccuracySec=100ms
Unit=railiance-clock-health.service
[Install]
WantedBy=timers.target

29
ansible/roles/railiance_clock/templates/railiance-clock.service.j2 Normal file
View file

@ -0,0 +1,29 @@
[Unit]
Description=Private Railiance application time authority
After=network.target railiance-clock-health.service
Requires=railiance-clock-health.service
[Service]
User=railiance-clock
Group=railiance-clock
ExecStart={{ railiance_clock_install_root }}/venv/bin/railiance-clock serve --config {{ railiance_clock_install_root }}/authority.json
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6
IPAddressDeny=any
IPAddressAllow=localhost
MemoryMax=128M
TasksMax=32
UMask=0077
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target

7
ansible/roles/railiance_clock/templates/timesyncd.conf.j2 Normal file
View file

@ -0,0 +1,7 @@
# Managed by railiance-infra; {{ railiance_clock_admission_ref }}.
[Time]
NTP={{ railiance_clock_upstreams | join(' ') }}
FallbackNTP=
PollIntervalMinSec=32
PollIntervalMaxSec=64
RootDistanceMaxSec=500ms