coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Activate production Clock authority and verify host convergence
All checks were successful
CI Smoke / source-contract (push) Successful in 14s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-15 23:13:42 +02:00
parent 07a0c07b7c
commit 62b393ebc6
4 changed files with 25 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
ansible/roles/railiance_clock/templates/railiance-clock-health.service.j2
View file

@ -12,7 +12,9 @@ ProtectSystem=strict
ReadWritePaths={{ railiance_clock_health_root }}
ProtectHome=yes
PrivateTmp=yes
ProtectClock=yes
# adjtimex(modes=0) is read-only but ProtectClock blocks the syscall entirely.
# Empty capability sets still deny clock writes, including nonzero adjtimex modes.
ProtectClock=no
RestrictAddressFamilies=AF_UNIX
TimeoutStartSec=12
UMask=0022