From 1566ed593907c829827237aad924c3f527723218 Mon Sep 17 00:00:00 2001
From: Luke Hoersten <luke@hoersten.org>
Date: Sun, 26 Jul 2026 11:49:11 -0500
Subject: mattertimesync: add build + server roles

Build role compiles the tagged source on the build host (npm ci + npm run
bundle) into a versioned mattertimesync-<ver>.tar.gz in build_srv_dir. Server
role installs the single bundled .mjs, creates the mattertimesync service user
and a 0700 storage dir for the Matter fabric keys, templates config.json, and
runs a hardened oneshot sync via a systemd timer. Both roles depend on the
nodejs role for Node >=20.
---
 mattertimesync/server/templates/config.json.j2            |  5 +++++
 mattertimesync/server/templates/mattertimesync.service.j2 | 15 +++++++++++++++
 mattertimesync/server/templates/mattertimesync.timer.j2   | 10 ++++++++++
 3 files changed, 30 insertions(+)
 create mode 100644 mattertimesync/server/templates/config.json.j2
 create mode 100644 mattertimesync/server/templates/mattertimesync.service.j2
 create mode 100644 mattertimesync/server/templates/mattertimesync.timer.j2

(limited to 'mattertimesync/server/templates')

diff --git a/mattertimesync/server/templates/config.json.j2 b/mattertimesync/server/templates/config.json.j2
new file mode 100644
index 0000000..0ace585
--- /dev/null
+++ b/mattertimesync/server/templates/config.json.j2
@@ -0,0 +1,5 @@
+{
+  "storagePath": "{{mattertimesync_storage_path}}",
+  "timezone": "{{mattertimesync_timezone}}",
+  "logLevel": "{{mattertimesync_log_level}}"
+}
diff --git a/mattertimesync/server/templates/mattertimesync.service.j2 b/mattertimesync/server/templates/mattertimesync.service.j2
new file mode 100644
index 0000000..e47cc35
--- /dev/null
+++ b/mattertimesync/server/templates/mattertimesync.service.j2
@@ -0,0 +1,15 @@
+[Unit]
+Description=Matter device clock synchronization
+Wants=network-online.target
+After=network-online.target time-sync.target
+
+[Service]
+Type=oneshot
+User={{mattertimesync_user}}
+Group={{mattertimesync_user}}
+ExecStart=/usr/bin/node {{mattertimesync_install_dir}}/mattertimesync.mjs --config {{mattertimesync_config_dir}}/config.json sync
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths={{mattertimesync_storage_path}}
diff --git a/mattertimesync/server/templates/mattertimesync.timer.j2 b/mattertimesync/server/templates/mattertimesync.timer.j2
new file mode 100644
index 0000000..e378dfc
--- /dev/null
+++ b/mattertimesync/server/templates/mattertimesync.timer.j2
@@ -0,0 +1,10 @@
+[Unit]
+Description=Periodic Matter device clock synchronization
+
+[Timer]
+OnBootSec={{mattertimesync_on_boot_sec}}
+OnUnitActiveSec={{mattertimesync_on_active_sec}}
+RandomizedDelaySec={{mattertimesync_randomized_delay_sec}}
+
+[Install]
+WantedBy=timers.target
-- 
cgit v1.2.3