56 lines
1.5 KiB
Desktop File
56 lines
1.5 KiB
Desktop File
[Unit]
|
|
Description=VesperOS Profile Daemon (profiles + Zero-Touch Enrollment)
|
|
Documentation=https://vesperos.oxmc.me/docs/vesperprofiled
|
|
|
|
# Must run before cloud-init so preinstalled profiles (WiFi, MDM drop-ins,
|
|
# first-boot config) are on disk when cloud-init starts.
|
|
Before=cloud-init-local.service cloud-init.service
|
|
After=local-fs.target dbus.service systemd-udev-settle.service
|
|
|
|
# Start after NetworkManager so ZTE can immediately check current
|
|
# connectivity state rather than waiting for a StateChanged signal.
|
|
After=NetworkManager.service
|
|
# But don't hard-require NM — ZTE degrades gracefully if NM isn't present.
|
|
Wants=NetworkManager.service
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=main
|
|
|
|
ExecStart=/usr/sbin/vesperprofiled
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
|
|
User=root
|
|
Group=root
|
|
|
|
# Restart the whole daemon (profile service + ZTE watcher) on crash.
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
TimeoutStartSec=60
|
|
|
|
RuntimeDirectory=vesperprofiled
|
|
RuntimeDirectoryMode=0750
|
|
StateDirectory=vesperprofiled
|
|
StateDirectoryMode=0700
|
|
|
|
# Writable paths — profile daemon writes config drops, ZTE writes state
|
|
ReadWritePaths=/etc /var/lib/vesperprofiled /run/vesperprofiled \
|
|
/var/lib/gnome-initial-setup
|
|
|
|
SystemCallFilter=@system-service @file-system @network-io @process
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
NoNewPrivileges=false
|
|
PrivateTmp=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=vesperprofiled
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
WantedBy=cloud-init.target
|