coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add opt-in Railiance host time and private authority automation
All checks were successful
CI Smoke / source-contract (push) Successful in 16s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-15 21:59:29 +02:00
parent c402245207
commit 0d6cc3ec3b
13 changed files with 291 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

18
ansible/roles/railiance_clock/templates/railiance-clock-health.service.j2 Normal file
View file

@ -0,0 +1,18 @@
[Unit]
Description=Read-only Railiance host clock quality export
After=systemd-timesyncd.service
[Service]
Type=oneshot
ExecStart={{ railiance_clock_install_root }}/venv/bin/railiance-clock health-export --policy {{ railiance_clock_install_root }}/health-policy.json --output {{ railiance_clock_health_root }}/health.json
User=root
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
ProtectSystem=strict
ReadWritePaths={{ railiance_clock_health_root }}
ProtectHome=yes
PrivateTmp=yes
ProtectClock=yes
RestrictAddressFamilies=AF_UNIX
TimeoutStartSec=12
UMask=0022