ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-log-credential.service

@@ -0,0 +1,35 @@
+[Unit]
+Description=Update OCI L4 relay log ingestion credential
+Wants=network-online.target
+After=network-online.target oci-l4-relay-bootstrap.service
+ConditionPathExists=/etc/oci-l4-relay/config.json
+StartLimitIntervalSec=10m
+StartLimitBurst=20
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/oci-l4-relay-guest logs update
+LogNamespace=oci-l4-relay
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadWritePaths=/etc/oci-l4-relay
+Restart=on-failure
+RestartSec=30s
+RestrictAddressFamilies=AF_UNIX AF_INET
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077