ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-vlagent.service

@@ -0,0 +1,42 @@
+[Unit]
+Description=Buffer OCI L4 relay journals for VictoriaLogs
+Wants=network-online.target
+After=network-online.target oci-l4-relay-bootstrap.service
+ConditionPathExists=/etc/oci-l4-relay/log-ingest.token
+PartOf=oci-l4-relay-logs.target
+
+[Service]
+Type=simple
+User=oci-l4-relay-logs
+Group=oci-l4-relay-logs
+StateDirectory=oci-l4-relay-logs
+ExecStart=/usr/local/bin/vlagent -httpListenAddr=127.0.0.1:19532 -journald.ignoreFields=__CURSOR,__MONOTONIC_TIMESTAMP,__SEQNUM,__SEQNUM_ID,_AUDIT_LOGINUID,_AUDIT_SESSION,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_MACHINE_ID,_PID,_RUNTIME_SCOPE,_SELINUX_CONTEXT,_SOURCE_REALTIME_TIMESTAMP,_SYSTEMD_CGROUP,_SYSTEMD_INVOCATION_ID,_SYSTEMD_SLICE,_SYSTEMD_USER_SLICE,_SYSTEMD_USER_UNIT,_TRANSPORT,_UID -journald.streamFields=_SYSTEMD_UNIT,_HOSTNAME -memory.allowedBytes=67108864 -remoteWrite.bearerTokenFile=/etc/oci-l4-relay/log-ingest.token -remoteWrite.maxDiskUsagePerURL=536870912 -remoteWrite.rateLimit=1048576 -remoteWrite.tmpDataPath=/var/lib/oci-l4-relay-logs -remoteWrite.url=https://relay-logs.quorate.dev/insert/native
+Restart=on-failure
+RestartSec=10s
+Slice=oci-l4-relay-logs.slice
+CapabilityBoundingSet=
+IPAddressDeny=any
+IPAddressAllow=localhost
+IPAddressAllow=10.104.40.127
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadOnlyPaths=/etc/oci-l4-relay/log-ingest.token
+ReadWritePaths=/var/lib/oci-l4-relay-logs
+RestrictAddressFamilies=AF_UNIX AF_INET
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077