# The db-read worker (db region forward spec §8.3): one instance per
# connection to carlos-dbread.socket. It writes one forwarded read's planned
# LTX files into its own private /var/tmp, restores them, checks the copy,
# and runs the member's one read-only statement. Everything that decodes
# tenant bytes runs here, as a DynamicUser with no network; the agent only
# moves bytes. systemd removes /tmp and /var/tmp when the unit stops,
# however it stops.
#
# StandardInput/StandardOutput=socket: with Accept=yes systemd passes the
# connection as a descriptor and puts it on stdin only when told to. The
# claim-bound template's StandardOutput=file: line is deliberately absent.
#
# LimitFSIZE is the default restored-size cap (CARLOS_DB_READ_MAX_BYTES,
# 2 GiB). A box that raises the cap needs a drop-in raising this too.
[Unit]
Description=carlos db-read worker

[Service]
ExecStart=/opt/carlos/carlos system db-worker
StandardInput=socket
StandardOutput=socket
StandardError=journal
DynamicUser=yes
PrivateNetwork=yes
RestrictAddressFamilies=AF_UNIX
TemporaryFileSystem=/data:ro /var/lib:ro /opt/carlos:ro /run/carlos:ro
BindReadOnlyPaths=/opt/carlos/carlos
InaccessiblePaths=/etc/carlos -/run/carlos-control
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
PrivateDevices=yes
ProtectProc=invisible
ProcSubset=pid
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectClock=yes
ProtectHostname=yes
ProtectControlGroups=yes
RemoveIPC=yes
LockPersonality=yes
RestrictRealtime=yes
RestrictNamespaces=yes
RestrictSUIDSGID=yes
NoNewPrivileges=yes
CapabilityBoundingSet=
SystemCallFilter=@system-service
SystemCallArchitectures=native
MemoryDenyWriteExecute=yes
MemoryMax=512M
CPUQuota=100%
TasksMax=16
LimitFSIZE=2147483648
RuntimeMaxSec=20min