feat: add TallyNote local reimbursement ledger

2026-08-29 01:02:29 +08:00
commit 9719429f4a
62 changed files with 29200 additions and 0 deletions
@@ -0,0 +1,10 @@
+[Unit]
+Description=Watch for TallyNote release update requests
+
+[Path]
+PathExists=/var/lib/tallynote/update-request.json
+PathChanged=/var/lib/tallynote/update-request.json
+Unit=tallynote-update.service
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,33 @@
+[Unit]
+Description=TallyNote privileged release updater
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/var/lib/tallynote/update-request.json
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+WorkingDirectory=/opt/tallynote/current
+EnvironmentFile=-/etc/tallynote/tallynote.env
+ExecStart=/usr/local/libexec/tallynote-update-runner
+Environment=PATH=/usr/sbin:/usr/bin:/sbin:/bin
+NoNewPrivileges=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+UMask=0077
+ReadWritePaths=/opt/tallynote /var/lib/tallynote /var/lib/tallynote-backups
@@ -0,0 +1,15 @@
+TALLYNOTE_HOST=127.0.0.1
+TALLYNOTE_PORT=3000
+TALLYNOTE_DATA_DIR=/var/lib/tallynote
+TALLYNOTE_INSTALL_PREFIX=/opt/tallynote
+TALLYNOTE_PUBLIC_ORIGIN=http://127.0.0.1:3000
+TALLYNOTE_COOKIE_SECURE=false
+TALLYNOTE_TIMEZONE=Asia/Shanghai
+TALLYNOTE_UPDATE_STRATEGY=systemd
+TALLYNOTE_UPDATE_METADATA_URL=https://git.awaioi.com/api/v1/repos/awaioi/TallyNote/releases/latest
+TALLYNOTE_UPDATE_ALLOWED_HOSTS=git.awaioi.com
+TALLYNOTE_UPDATE_REQUIRE_SIGNATURE=true
+TALLYNOTE_UPDATE_CHECK_COOLDOWN_SECONDS=60
+TALLYNOTE_UPDATE_APPLY_COOLDOWN_SECONDS=15
+# Configure a root-managed Ed25519 public key before enabling one-click updates.
+# TALLYNOTE_UPDATE_PUBLIC_KEY_FILE=/etc/tallynote/update-signing-key.pub
@@ -0,0 +1,38 @@
+[Unit]
+Description=TallyNote expense records
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=tallynote
+Group=tallynote
+WorkingDirectory=/opt/tallynote/current
+Environment=NODE_ENV=production
+EnvironmentFile=-/etc/tallynote/tallynote.env
+Environment=PATH=/opt/tallynote/current/runtime/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/opt/tallynote/current/bin/tallynote
+Restart=on-failure
+RestartSec=5s
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+InaccessiblePaths=/opt/tallynote/.update-work
+ProtectHome=true
+PrivateDevices=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+UMask=0077
+ReadWritePaths=/var/lib/tallynote
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target