feat: add production deployment handoff controls

2026-07-10 16:41:14 +09:00
parent 7cea023dce
commit aa284e9bd4
14 changed files with 408 additions and 109 deletions
@@ -0,0 +1,17 @@
+[Unit]
+Description=CASAN immutable audit-head anchor
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=casan
+Group=casan
+EnvironmentFile=/etc/casan/production.env
+Environment=CASAN_PROFILE=prod
+ExecStart=/srv/casan/repo/packages/casan-harness/scripts/bash/audit-ship-s3.sh /srv/casan/state/logs/audit/audit-head.txt
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/srv/casan/state
@@ -0,0 +1,11 @@
+[Unit]
+Description=Periodically anchor CASAN audit head to S3 Object Lock
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=5min
+Persistent=true
+Unit=casan-audit-anchor.service
+
+[Install]
+WantedBy=timers.target