mirror of
https://gitlab.com/pezkuwichain/pezkuwi-sdk.git
synced 2026-10-20 18:56:23 +00:00
Satoshi Qazi Muhammed
d285d59108
Make this monorepo's tracked tree identical to the deployed github repo (github.com/pezkuwichain/pezkuwi-DKS): all RC/AH/People runtimes and framework carry the mainnet fixes (incl. U128CurrencyToVote everywhere, so the staking election stall cannot recur), and tools/usdt-bridge matches the current, public-safe custody tooling (real config/deploy units gitignored, secret-file locations and server IPs stripped, sanitized *.example templates committed). Only exception to the mirror: GitLab-native CI is preserved (.gitlab-ci.yml and .gitlab/), to be rebuilt to match the github CI pipeline in a follow-up.
50 lines
1.4 KiB
Plaintext
50 lines
1.4 KiB
Plaintext
# PezbridgeBot — example systemd unit.
|
|
# Read-only allowance-renewal notifier: reads chain state and sends Telegram alerts when the
|
|
# automation-key allowance needs a 3-of-5-signed renewal. Holds NO signing key and cannot submit
|
|
# anything. Copy to /etc/systemd/system/, fill in <PLACEHOLDERS>, provide the Telegram token
|
|
# ONLY via the EnvironmentFile below (never in the repo).
|
|
[Unit]
|
|
Description=PezbridgeBot - allowance renewal notifier (holds no key)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=<service-user>
|
|
Group=<service-group>
|
|
WorkingDirectory=<WORKDIR>
|
|
ExecStart=<BIN_DIR>/pezbridge-bot
|
|
Environment=PEZBRIDGE_CONFIG=<CONFIG_PATH>/pezbridge_bot_config.json
|
|
Environment=RUST_LOG=info
|
|
EnvironmentFile=<SECRETS_DIR>/telegram_token.env
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
|
|
# Hardening (recommended baseline)
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictSUIDSGID=yes
|
|
RemoveIPC=yes
|
|
LockPersonality=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallFilter=@system-service
|
|
SystemCallArchitectures=native
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
ReadWritePaths=<WORKDIR>
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|