582823a89c
Hubris is Netbird-only and LXC 105 is Tailscale-only; they share LAN but not a mesh, so on-host \`curl http://192.168.8.205:9820/issue\` arrives with source IP 192.168.8.77. In a homelab LAN with no untrusted devices the trust boundary is reasonable; if that changes later, narrow this. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
24 lines
749 B
Desktop File
24 lines
749 B
Desktop File
[Unit]
|
|
Description=Homelab secrets-issuance (per-client age key provisioning)
|
|
After=network-online.target homelab-context-sync.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
WorkingDirectory=/opt/secrets-issuance
|
|
Environment=HOMELAB_CONTEXT_DIR=/opt/homelab-context
|
|
Environment=SECRETS_ISSUANCE_STATE=/var/lib/secrets-issuance
|
|
Environment=MESH_SUBNETS=100.122.0.0/16,100.64.0.0/10,192.168.8.0/24
|
|
ExecStart=/opt/secrets-issuance/.venv/bin/python /opt/secrets-issuance/secrets-issuance/server.py
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
NoNewPrivileges=true
|
|
ReadOnlyPaths=/opt/homelab-context /opt/secrets-issuance
|
|
ReadWritePaths=/var/lib/secrets-issuance
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|