merge: testing → main (reconcile 2-week divergence)

deploy/decnet-swarmctl.service.j2

@@ -0,0 +1,43 @@
+[Unit]
+Description=DECNET Swarm Controller (master)
+Documentation=https://git.resacachile.cl/anti/DECNET/wiki/SWARM-Mode
+After=network-online.target decnet-api.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User={{ user }}
+Group={{ group }}
+WorkingDirectory={{ install_dir }}
+EnvironmentFile=-{{ install_dir }}/.env.local
+# Default bind is loopback — the controller is a master-local orchestrator
+# reached by the CLI and the web dashboard, not by workers.
+Environment=DECNET_SYSTEM_LOGS=/var/log/decnet/decnet.swarmctl.log
+ExecStart={{ venv_dir }}/bin/decnet swarmctl --host 127.0.0.1 --port 8770
+StandardOutput=append:/var/log/decnet/decnet.swarmctl.log
+StandardError=append:/var/log/decnet/decnet.swarmctl.log
+
+# No special capabilities — the controller issues mTLS certs and talks to
+# workers over TCP on unprivileged ports.
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+# Security Hardening
+NoNewPrivileges=yes
+ProtectSystem=full
+ProtectHome=read-only
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+# Reads/writes the CA bundle and the master DB.
+ReadWritePaths={{ install_dir }} /var/log/decnet
+ReadOnlyPaths=/etc/decnet
+
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target