feat: add TallyNote local reimbursement ledger

2026-08-29 01:02:29 +08:00
commit 9719429f4a
62 changed files with 29200 additions and 0 deletions
@@ -0,0 +1,33 @@
+[Unit]
+Description=TallyNote privileged release updater
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/var/lib/tallynote/update-request.json
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+WorkingDirectory=/opt/tallynote/current
+EnvironmentFile=-/etc/tallynote/tallynote.env
+ExecStart=/usr/local/libexec/tallynote-update-runner
+Environment=PATH=/usr/sbin:/usr/bin:/sbin:/bin
+NoNewPrivileges=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+UMask=0077
+ReadWritePaths=/opt/tallynote /var/lib/tallynote /var/lib/tallynote-backups