Package portable grid agent operation (#134)

packaging/metacrate-grid-agent/systemd/grid-agent.env.example

@@ -0,0 +1,7 @@
+# Values here are paths and non-secret mode settings only. Never put secret
+# values in this file. Create every referenced file as mode 0600, owned by the
+# metacrate-agent service identity.
+METACRATE_AGENT_LLM_API_KEY_FILE=/etc/metacrate/secrets/llm-api-key
+METACRATE_AGENT_GRID_PASSWORD_FILE=/etc/metacrate/secrets/grid-password
+METACRATE_AGENT_CONTROL_OPERATOR_TOKEN_FILE=/etc/metacrate/secrets/control-operator-token
+METACRATE_AGENT_STORAGE_PATH=/var/lib/metacrate/grid-agent

packaging/metacrate-grid-agent/systemd/metacrate-grid-agent.service

@@ -0,0 +1,38 @@
+[Unit]
+Description=MetaCrate OpenSim grid agent
+Documentation=https://git.rfc1437.de/hugo/MetaCrate
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=metacrate-agent
+Group=metacrate-agent
+EnvironmentFile=-/etc/metacrate/grid-agent.env
+ExecStartPre=/usr/local/bin/metacrate-grid-agent --config /etc/metacrate/grid-agent.json --check-config
+ExecStart=/usr/local/bin/metacrate-grid-agent --config /etc/metacrate/grid-agent.json
+KillSignal=SIGINT
+TimeoutStopSec=30s
+Restart=on-failure
+RestartSec=5s
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadOnlyPaths=/etc/metacrate
+ReadWritePaths=/var/lib/metacrate/grid-agent
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target