Package portable grid agent operation (#134)

packaging/metacrate-grid-agent/install.ps1

@@ -0,0 +1,15 @@
+param(
+    [Parameter(Mandatory = $true)][string]$BuiltBinary,
+    [Parameter(Mandatory = $true)][string]$DestinationDirectory
+)
+$ErrorActionPreference = "Stop"
+if (-not (Test-Path -LiteralPath $BuiltBinary -PathType Leaf)) {
+    throw "BuiltBinary is not a regular file"
+}
+New-Item -ItemType Directory -Force -Path $DestinationDirectory | Out-Null
+$temporary = Join-Path $DestinationDirectory ".metacrate-grid-agent.new.exe"
+Copy-Item -LiteralPath $BuiltBinary -Destination $temporary -Force
+Move-Item -LiteralPath $temporary -Destination (Join-Path $DestinationDirectory "metacrate-grid-agent.exe") -Force
+
+# Configuration, secrets, conversations, landmarks, and journals live outside
+# this directory and are deliberately never created, replaced, or removed.

packaging/metacrate-grid-agent/install.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: install.sh BUILT_BINARY DESTINATION_PREFIX" >&2
+  exit 2
+fi
+
+source_binary=$1
+destination_prefix=$2
+test -f "$source_binary"
+install -d -m 0755 "$destination_prefix/bin"
+temporary="$destination_prefix/bin/.metacrate-grid-agent.new"
+install -m 0755 "$source_binary" "$temporary"
+mv -f "$temporary" "$destination_prefix/bin/metacrate-grid-agent"
+
+# Deliberately do not create, replace, migrate, or remove configuration,
+# secrets, conversations, landmarks, or audit journals.

packaging/metacrate-grid-agent/systemd/grid-agent.env.example

@@ -0,0 +1,7 @@
+# Values here are paths and non-secret mode settings only. Never put secret
+# values in this file. Create every referenced file as mode 0600, owned by the
+# metacrate-agent service identity.
+METACRATE_AGENT_LLM_API_KEY_FILE=/etc/metacrate/secrets/llm-api-key
+METACRATE_AGENT_GRID_PASSWORD_FILE=/etc/metacrate/secrets/grid-password
+METACRATE_AGENT_CONTROL_OPERATOR_TOKEN_FILE=/etc/metacrate/secrets/control-operator-token
+METACRATE_AGENT_STORAGE_PATH=/var/lib/metacrate/grid-agent

packaging/metacrate-grid-agent/systemd/metacrate-grid-agent.service

@@ -0,0 +1,38 @@
+[Unit]
+Description=MetaCrate OpenSim grid agent
+Documentation=https://git.rfc1437.de/hugo/MetaCrate
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=metacrate-agent
+Group=metacrate-agent
+EnvironmentFile=-/etc/metacrate/grid-agent.env
+ExecStartPre=/usr/local/bin/metacrate-grid-agent --config /etc/metacrate/grid-agent.json --check-config
+ExecStart=/usr/local/bin/metacrate-grid-agent --config /etc/metacrate/grid-agent.json
+KillSignal=SIGINT
+TimeoutStopSec=30s
+Restart=on-failure
+RestartSec=5s
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadOnlyPaths=/etc/metacrate
+ReadWritePaths=/var/lib/metacrate/grid-agent
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target