Initial server source import

deploy/host-agent/truf-host-agent.service

@@ -0,0 +1,50 @@
+[Unit]
+Description=Truf privileged host operations agent
+Requires=truf-host-agent.socket docker.service
+After=truf-host-agent.socket docker.service
+
+[Service]
+Type=exec
+User=root
+Group=root
+UMask=0077
+WorkingDirectory=/
+ExecStartPre=/usr/bin/python3 -I -B /usr/lib/truf-host-agent/truf_host_agent_install.py validate
+ExecStart=/usr/bin/python3 -I -B /usr/lib/truf-host-agent/truf_host_agent.py
+RuntimeDirectory=truf-host-agent
+RuntimeDirectoryMode=0700
+NoNewPrivileges=yes
+CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
+AmbientCapabilities=
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProcSubset=pid
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+ReadWritePaths=/etc/truf/runtime
+ReadWritePaths=/var/lib/truf/host-agent
+ReadWritePaths=/run/truf-host-agent
+ReadWritePaths=/run/docker.sock
+ReadOnlyPaths=/usr/lib/truf-host-agent
+ReadOnlyPaths=/opt/truf
+ReadOnlyPaths=/var/lib/truf/runtime-document-candidates
+ReadOnlyPaths=/run/truf-postgres
+Restart=no
+TimeoutStopSec=45min
+StandardOutput=null
+StandardError=journal