113c755e23
Six fixes addressing operational correctness on a real Debian host:
1. Ownership after git operations: chown -R zopu:zopu on the checkout
after clone/update/rollback before running bun install/build as the
service user. .env kept at 0600 with explicit chmod after each
operation.
2. sudo replaced with runuser: minimal Debian does not include sudo.
runuser is part of util-linux (essential) and always available.
All three scripts (bootstrap, update, rollback) now use runuser -u.
3. cron.d entry fixed: /etc/cron.d format requires a username field.
Added ${SERVICE_USER} between the time fields and the command path.
4. Firewall: added explicit `ufw allow in on tailscale0` rule so the
deny-incoming default does not block Tailscale private-overlay
reachability. Removed inaccurate claim that direct private IP works
by default; documented that an explicit per-interface rule is needed.
5. SupplementaryGroups=docker added to zopu-agent.service: the Orb
sandbox runtime lives in the agent process, not just the daemon.
6. zopu-health.service: added Environment=ENV_FILE=__INSTALL_DIR__/.env
so health-check.sh sources the correct .env at custom install paths.
Verified Flue build output: bun run build:agents produces
packages/agents/dist/server.mjs (confirmed by running the build).
Agent unit ExecStart path is correct.
Validated: bash -n on all 6 shell scripts; mocked health-check smoke
against live RivetKit engine on port 6420; systemd unit structural
checks. No JS/TS/agent files changed.
40 lines
821 B
Desktop File
40 lines
821 B
Desktop File
[Unit]
|
|
Description=Zopu Agent Service (Flue Node server)
|
|
After=network-online.target zopu-daemon.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=__SERVICE_USER__
|
|
Group=__SERVICE_USER__
|
|
WorkingDirectory=__INSTALL_DIR__/packages/agents
|
|
|
|
EnvironmentFile=__INSTALL_DIR__/.env
|
|
|
|
# Flue build output: packages/agents/dist/server.mjs
|
|
# Listens on PORT (default 3583 per .env.template).
|
|
ExecStart=/usr/local/bin/bun dist/server.mjs
|
|
|
|
Restart=always
|
|
RestartSec=10
|
|
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=zopu-agent
|
|
|
|
# Resource limits
|
|
MemoryMax=8G
|
|
CPUWeight=80
|
|
|
|
# Security hardening
|
|
NoNewPrivileges=true
|
|
ProtectSystem=full
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
|
|
# Docker socket access for Orb sandbox runtime (lives in agent process)
|
|
SupplementaryGroups=docker
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|