# One release-adoption pass (release.Pass): resolve channel pointers, verify
# signatures, stage new versions under /opt/carlos/versions, repoint live
# symlinks, cycle systemd-managed routes. Fired hourly by carlos-adopt.timer.
# The agent also runs an in-process adopt loop, but that loop lives inside the
# sandboxed edge unit (ProtectSystem=strict, no /opt write) — this root oneshot
# is what actually stages on a hardened box. Shaped after Eleven's
# deploy/systemd/lchat-update.service.
[Unit]
Description=carlos adopt (one release-adoption pass)
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
# CARLOS_DEPLOYMENT_BUCKET/_DIR + CARLOS_RELEASE_PUBKEY live here.
EnvironmentFile=-/etc/carlos/host.env
ExecStart=/opt/carlos/carlos adopt

# --- hardening ---
# Runs as ROOT deliberately (like Eleven's updater): a pass writes the version
# store (/opt/carlos) and restarts instance units via systemctl. NoNewPrivileges
# and the syscall filter are omitted for the systemctl child; the rest applies.
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
MemoryMax=256M
TasksMax=64