Initial server source import

deploy/systemd/truf-caddy-admin-denylist-expire.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Expire Truf Caddy admin-only denylist entries
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+ExecStart=/usr/local/sbin/truf-caddy-admin-denylist expire
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/truf-edge /etc/truf-edge/denylist
+RestrictAddressFamilies=AF_UNIX
+LockPersonality=true
+MemoryDenyWriteExecute=true