29 lines
1.3 KiB
Desktop File
29 lines
1.3 KiB
Desktop File
[Unit]
|
|
Description=Archipelago host-secret audit (are this node's SSH/TLS keys per-node?)
|
|
Documentation=file:///opt/archipelago/scripts/security/host-secrets-audit.sh
|
|
# Ordered after first-boot regeneration so a fresh node is judged on the keys
|
|
# it ends up with, not the ones it booted with. network.target because the
|
|
# fingerprints are only meaningful once the node has an identity to report as.
|
|
After=archipelago-first-boot-secrets.service network.target
|
|
ConditionPathExists=/opt/archipelago/scripts/security/host-secrets-audit.sh
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# Reads /etc/ssh and /etc/archipelago/ssl and writes
|
|
# /var/lib/archipelago/host-secrets-audit.json, all of which are root-owned.
|
|
User=root
|
|
# DETECT ONLY. D-06 chose detect-report-then-apply
|
|
# (docs/security/KEY-02-FLEET-ROTATION.md): rotation is one-way and must never
|
|
# fire unattended across the fleet during an OTA. There is deliberately NO
|
|
# --apply here. Adding one is a decision, not a configuration change.
|
|
ExecStart=-/opt/archipelago/scripts/security/host-secrets-audit.sh --detect
|
|
# The leading `-` above: a failed audit must never fail a boot. The verdict is
|
|
# informational; a node that cannot be judged is still a node that must come up.
|
|
TimeoutStartSec=60
|
|
RemainAfterExit=yes
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|