Archipelago — open-source initial import

image-recipe/configs/archipelago-host-secrets-audit.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=Archipelago host-secret audit (are this node's SSH/TLS keys per-node?)
+Documentation=file:///opt/archipelago/scripts/security/host-secrets-audit.sh
+# Ordered after first-boot regeneration so a fresh node is judged on the keys
+# it ends up with, not the ones it booted with. network.target because the
+# fingerprints are only meaningful once the node has an identity to report as.
+After=archipelago-first-boot-secrets.service network.target
+ConditionPathExists=/opt/archipelago/scripts/security/host-secrets-audit.sh
+
+[Service]
+Type=oneshot
+# Reads /etc/ssh and /etc/archipelago/ssl and writes
+# /var/lib/archipelago/host-secrets-audit.json, all of which are root-owned.
+User=root
+# DETECT ONLY. D-06 chose detect-report-then-apply
+# rotation is one-way and must never
+# fire unattended across the fleet during an OTA. There is deliberately NO
+# --apply here. Adding one is a decision, not a configuration change.
+ExecStart=-/opt/archipelago/scripts/security/host-secrets-audit.sh --detect
+# The leading `-` above: a failed audit must never fail a boot. The verdict is
+# informational; a node that cannot be judged is still a node that must come up.
+TimeoutStartSec=60
+RemainAfterExit=yes
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target