coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add opt-in Railiance host time and private authority automation
All checks were successful
CI Smoke / source-contract (push) Successful in 16s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-15 21:59:29 +02:00
parent c402245207
commit 0d6cc3ec3b
13 changed files with 291 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

29
ansible/roles/railiance_clock/templates/railiance-clock.service.j2 Normal file
View file

@ -0,0 +1,29 @@
[Unit]
Description=Private Railiance application time authority
After=network.target railiance-clock-health.service
Requires=railiance-clock-health.service
[Service]
User=railiance-clock
Group=railiance-clock
ExecStart={{ railiance_clock_install_root }}/venv/bin/railiance-clock serve --config {{ railiance_clock_install_root }}/authority.json
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6
IPAddressDeny=any
IPAddressAllow=localhost
MemoryMax=128M
TasksMax=32
UMask=0077
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target