# The db-read worker's socket (db region forward spec §8.3). Bound by root
# systemd and owned by carlos, so the agent connects with no privilege of
# its own. Each connection starts one carlos-dbread@ instance with the
# connection as its stdin and stdout. Three connections at most: two reads
# and the readiness probe (spec §7.1).
#
# It lives under /run/carlos because every tenant unit hides that tree
# (TemporaryFileSystem=/run/carlos:ro): tenants run as carlos too, the one
# uid the worker serves, so they must not be able to see this path. Only
# ensureSystemUnits arms it, and only on a box whose host.env arms db reads;
# elsewhere nothing listens (Astra round 1, finding 1).
[Unit]
Description=carlos db-read worker socket

[Socket]
ListenStream=/run/carlos/dbread/worker.sock
SocketUser=carlos
SocketGroup=carlos
SocketMode=0600
Accept=yes
MaxConnections=3

[Install]
WantedBy=sockets.target