From 1566ed593907c829827237aad924c3f527723218 Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Sun, 26 Jul 2026 11:49:11 -0500 Subject: mattertimesync: add build + server roles Build role compiles the tagged source on the build host (npm ci + npm run bundle) into a versioned mattertimesync-.tar.gz in build_srv_dir. Server role installs the single bundled .mjs, creates the mattertimesync service user and a 0700 storage dir for the Matter fabric keys, templates config.json, and runs a hardened oneshot sync via a systemd timer. Both roles depend on the nodejs role for Node >=20. --- mattertimesync/server/templates/mattertimesync.service.j2 | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 mattertimesync/server/templates/mattertimesync.service.j2 (limited to 'mattertimesync/server/templates/mattertimesync.service.j2') diff --git a/mattertimesync/server/templates/mattertimesync.service.j2 b/mattertimesync/server/templates/mattertimesync.service.j2 new file mode 100644 index 0000000..e47cc35 --- /dev/null +++ b/mattertimesync/server/templates/mattertimesync.service.j2 @@ -0,0 +1,15 @@ +[Unit] +Description=Matter device clock synchronization +Wants=network-online.target +After=network-online.target time-sync.target + +[Service] +Type=oneshot +User={{mattertimesync_user}} +Group={{mattertimesync_user}} +ExecStart=/usr/bin/node {{mattertimesync_install_dir}}/mattertimesync.mjs --config {{mattertimesync_config_dir}}/config.json sync +NoNewPrivileges=true +PrivateTmp=true +ProtectSystem=strict +ProtectHome=true +ReadWritePaths={{mattertimesync_storage_path}} -- cgit v1.2.3