# One RESTART-REQUEST pass (`carlos restart`, issue #113): cycle the units of
# every app whose restart generation has moved since this box last acted, and
# nothing else. Started only by carlos-restart.path, which fires when the agent
# touches /data/restart-requested; it has no [Install] section because nothing
# else should ever want it.
#
# Deliberately NOT carlos-adopt.service: that unit also runs release.Pass, the
# capability converge and the canary-TTL nag, so pointing a per-request trigger
# at it would let one tenant's `carlos restart` cut over ANOTHER app's pending
# release within seconds, and would nag on every request instead of hourly —
# the same split carlos-config-sync.service and carlos-stage.service already
# make. Same root + hardening shape as those two, which is what `systemctl
# try-restart` requires.
#
# It needs neither CARLOS_RELEASE_PUBKEY nor CARLOS_SECRETS_KEY: a restart
# verifies no signature and renders no config. The EnvironmentFile is still
# read for CARLOS_DEPLOYMENT_BUCKET/_DIR, which is where the request itself is.
[Unit]
Description=carlos instance restart (on agent request)
After=network-online.target
Wants=network-online.target
# A path unit re-triggers as often as members ask; the default start rate limit
# would latch this unit into start-limit-hit after a burst and then ignore every
# later trigger until an operator reset it. ([Unit], not [Service] — systemd
# moved these two keys in v230.)
StartLimitIntervalSec=0

[Service]
Type=oneshot
# CARLOS_DEPLOYMENT_BUCKET/_DIR lives here.
EnvironmentFile=-/etc/carlos/host.env
ExecStart=/opt/carlos/carlos adopt -restart-only

# --- hardening ---
# Runs as ROOT deliberately, exactly like carlos-adopt.service: this pass
# restarts carlos-app@ tenants and operator-named units via systemctl.
# NoNewPrivileges and the syscall filter are omitted for the systemctl child;
# the rest applies.
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
MemoryMax=256M
TasksMax=64