Native VM install kit: systemd units, launcher, install and upgrade scripts; backups, restore and doctor without docker exec; DEPLOY.md VM, NPM and NFS sections

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/vm/systemd/packetstation-worker.service

@@ -0,0 +1,67 @@
+# Packet Station: the worker (VISUAL feed, drawings, AD reconcile, integrity, backup check,
+# notifications, archive copies). Installed by deploy/vm/install.sh into /etc/systemd/system.
+# On production its first start is Spencer's approval of the scheduled VISUAL polling.
+[Unit]
+Description=Packet Station worker
+Documentation=file:///opt/packetstation/current/docs/DEPLOY.md
+Requires=packetstation-migrate.service
+After=packetstation-migrate.service [email protected] network-online.target
+Wants=[email protected] network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=5
+
+[Service]
+Type=exec
+User=packetstation
+Group=packetstation
+EnvironmentFile=/etc/packetstation/packetstation.env
+LoadCredential=postgres_app_password:/etc/packetstation/secrets/postgres_app_password
+LoadCredential=visualkit_password:/etc/packetstation/secrets/visualkit_password
+LoadCredential=mfileskit_password:/etc/packetstation/secrets/mfileskit_password
+LoadCredential=ldap_bind_password:/etc/packetstation/secrets/ldap_bind_password
+LoadCredential=seal_key:/etc/packetstation/secrets/seal_key
+ExecStart=/opt/packetstation/current/deploy/vm/ps-launch.sh worker
+SyslogIdentifier=packetstation-worker
+# /run/packetstation holds the heartbeat file (WORKER_BEAT_FILE, set by ps-launch.sh).
+RuntimeDirectory=packetstation
+RuntimeDirectoryMode=0755
+Restart=on-failure
+RestartSec=10s
+TimeoutStopSec=60s
+WorkingDirectory=/
+UMask=0027
+MemoryMax=1G
+
+# Sandbox. Read-only file system except the assets and the archive mount. The backup folder
+# (BACKUP_DIR) is only read, so it needs no entry here.
+ReadWritePaths=/var/lib/packetstation/assets
+ReadWritePaths=-/mnt/packetstation-archive
+InaccessiblePaths=/etc/packetstation/secrets
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+# AF_NETLINK: glibc's getaddrinfo asks the kernel for the local addresses through it.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+RemoveIPC=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+# Not set: MemoryDenyWriteExecute (see packetstation-app.service).
+
+[Install]
+WantedBy=multi-user.target