release: public alpha 0.6.0 baseline

2026-10-15 03:58:31 +08:00
commit d4242ae07c
238 changed files with 37724 additions and 0 deletions
@@ -0,0 +1,55 @@
+[Unit]
+Description=JWeBot isolated extension host for %i
+After=local-fs.target
+Requires=jwebot-extension-host@%i.socket
+ConditionPathExists=/etc/jwebot-extension-host/allowed_signers
+
+[Service]
+Type=exec
+User=jwebot-ext
+Group=jwebot-ext
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStart=/opt/jwebot-extension-host/venv/bin/python -I -m jwebot_extension_host --release-dir /var/lib/jwebot-extensions/%i/current --allowed-signers /etc/jwebot-extension-host/allowed_signers
+WorkingDirectory=/
+StandardInput=socket
+StandardOutput=socket
+StandardError=journal
+Restart=no
+TimeoutStartSec=12s
+RuntimeMaxSec=12s
+UMask=0077
+
+NoNewPrivileges=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+PrivateTmp=true
+PrivateDevices=true
+PrivateNetwork=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=invisible
+ProcSubset=pid
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+RestrictAddressFamilies=AF_UNIX
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @raw-io @reboot @swap
+
+MemoryMax=128M
+CPUQuota=50%
+TasksMax=16
+LimitNOFILE=64
+LimitNPROC=16
+LimitCORE=0
+
+ReadOnlyPaths=/var/lib/jwebot-extensions/%i
+InaccessiblePaths=/home /root /srv /mnt /media
@@ -0,0 +1,15 @@
+[Unit]
+Description=JWeBot extension host socket for %i
+
+[Socket]
+ListenStream=/run/jwebot-extension-host/%i.sock
+SocketUser=jwebot
+SocketGroup=jwebot
+SocketMode=0600
+DirectoryMode=0700
+RemoveOnStop=true
+Service=jwebot-extension-host@%i.service
+
+[Install]
+WantedBy=sockets.target
+
@@ -0,0 +1,21 @@
+[Unit]
+Description=Local OCR recorder for one fixed WeChat group
+After=tigervncserver@:1.service
+Requires=tigervncserver@:1.service
+
+[Service]
+Type=simple
+User=jwebot
+Group=jwebot
+EnvironmentFile=-/etc/default/wechat-local-ocr
+ExecStart=/opt/jwebot/venv/bin/python /usr/local/sbin/wechat-local-ocr record
+Restart=always
+RestartSec=3
+Nice=10
+UMask=0077
+MemoryMax=768M
+CPUQuota=150%
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,17 @@
+[Unit]
+Description=JWeBot responder for local WeChat OCR events
+After=wechat-local-ocr-recorder.service openclaw-tunnel.service
+Requires=wechat-local-ocr-recorder.service openclaw-tunnel.service
+
+[Service]
+Type=simple
+EnvironmentFile=-/etc/default/wechat-local-ocr
+ExecStart=/opt/jwebot/venv/bin/python /usr/local/sbin/wechat-local-ocr respond
+Restart=always
+RestartSec=3
+UMask=0077
+MemoryMax=256M
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target