# monky-deployd — one reconcile tick (MONKY-ADR-0028 §D). Fired by monky-deployd.timer.
[Unit]
Description=Monky backend pull agent (one tick: checkin -> bundle -> lease -> OpenBao -> compose -> report)
Documentation=https://scm.tikali.ai/tikali/applications/monky/monky-deployd
After=network-online.target docker.service ziti-edge-tunnel.service
Wants=network-online.target
# The proxy transport needs the local ziti proxy; harmless when the unit is disabled.
After=monky-deployd-proxy.service
ConditionPathExists=/etc/monky-deployd/config.yaml

[Service]
Type=oneshot
User=monky-deployd
Group=monky-deployd
SupplementaryGroups=docker
ExecStart=/usr/bin/monky-deployd run --once
# 75 = temporary network failure (next tick retries), 78 = AGENT_ENV_MISMATCH (operator action)
SuccessExitStatus=75
TimeoutStartSec=20min
Nice=5
Environment=PYTHONUNBUFFERED=1
Environment=MONKY_DEPLOYD_CONFIG=/etc/monky-deployd/config.yaml
UMask=0077
# hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictSUIDSGID=yes
RestrictRealtime=yes
LockPersonality=yes
# (no MemoryDenyWriteExecute: the openziti SDK's ctypes callbacks need libffi trampolines)
RestrictNamespaces=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
CapabilityBoundingSet=
AmbientCapabilities=
StateDirectory=monky-deployd
StateDirectoryMode=0700
ReadWritePaths=/var/lib/monky-deployd
# the bootstrap grant is deleted after the first login (the only write under /etc)
ReadWritePaths=/etc/monky-deployd
ReadOnlyPaths=-/opt/openziti/etc/identities
# docker socket + compose need the socket path writable
ReadWritePaths=-/var/run/docker.sock -/run/docker.sock

[Install]
WantedBy=multi-user.target