@le-space/rootfs 0.6.1 → 0.6.2

package/reference/ucan-store/rootfs/ucan-store-service-start.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENV_FILE="${ENV_FILE:-/etc/default/ucan-store}"
+APP_BINARY="${APP_BINARY:-/usr/local/bin/ucan-store}"
+BOOTSTRAP_VALIDATOR="${BOOTSTRAP_VALIDATOR:-/usr/local/sbin/ucan_store_bootstrap_validate.py}"
+BOOTSTRAP_CRYPTO_VERIFIER="${BOOTSTRAP_CRYPTO_VERIFIER:-/usr/local/sbin/ucan-store-bootstrap-verify.mjs}"
+REQUEST_GUARD="${REQUEST_GUARD:-/usr/local/sbin/ucan-store-request-guard.mjs}"
+BOOTSTRAP_PACKAGE_FILE_DEFAULT="${BOOTSTRAP_PACKAGE_FILE:-/etc/ucan-store/bootstrap-package.json}"
+BOOTSTRAP_VERIFICATION_FILE_DEFAULT="${BOOTSTRAP_VERIFICATION_FILE:-/etc/ucan-store/bootstrap-verification.json}"
+VERIFY_TIMEOUT_DEFAULT="${BOOTSTRAP_VERIFICATION_TIMEOUT_SECONDS:-60}"
+VERIFY_INTERVAL_DEFAULT="${BOOTSTRAP_VERIFICATION_INTERVAL_SECONDS:-2}"
+APP_PID=""
+GUARD_PID=""
+
+if [ -f "${ENV_FILE}" ]; then
+  set -a
+  # shellcheck disable=SC1090
+  . "${ENV_FILE}"
+  set +a
+fi
+
+SERVICE_PORT="${STORACHA_LOCAL_PORT:-8787}"
+BOOTSTRAP_PACKAGE_FILE="${UCAN_STORE_BOOTSTRAP_PACKAGE_FILE:-${BOOTSTRAP_PACKAGE_FILE_DEFAULT}}"
+BOOTSTRAP_VERIFICATION_FILE="${UCAN_STORE_BOOTSTRAP_VERIFICATION_FILE:-${BOOTSTRAP_VERIFICATION_FILE_DEFAULT}}"
+PUBLIC_UPLOAD_SERVICE_URL="${PUBLIC_UPLOAD_SERVICE_URL:-}"
+ADMIN_DID="${UCAN_STORE_ADMIN_DID:-}"
+VERIFY_TIMEOUT_SECONDS="${BOOTSTRAP_VERIFICATION_TIMEOUT_SECONDS:-${VERIFY_TIMEOUT_DEFAULT}}"
+VERIFY_INTERVAL_SECONDS="${BOOTSTRAP_VERIFICATION_INTERVAL_SECONDS:-${VERIFY_INTERVAL_DEFAULT}}"
+REQUIRE_BOOTSTRAP_PACKAGE="${UCAN_STORE_REQUIRE_BOOTSTRAP_PACKAGE:-1}"
+BOOTSTRAP_VALIDATION_MODE="enforce"
+
+is_truthy() {
+  case "${1:-}" in
+    1|true|TRUE|yes|YES|on|ON)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+terminate_child() {
+  if [ -n "${APP_PID}" ] && kill -0 "${APP_PID}" 2>/dev/null; then
+    kill "${APP_PID}" 2>/dev/null || true
+    wait "${APP_PID}" 2>/dev/null || true
+  fi
+  if [ -n "${GUARD_PID}" ] && kill -0 "${GUARD_PID}" 2>/dev/null; then
+    kill "${GUARD_PID}" 2>/dev/null || true
+    wait "${GUARD_PID}" 2>/dev/null || true
+  fi
+}
+
+validate_bootstrap_preflight() {
+  if [ ! -f "${BOOTSTRAP_PACKAGE_FILE}" ]; then
+    if is_truthy "${REQUIRE_BOOTSTRAP_PACKAGE}"; then
+      echo "Missing required bootstrap package: ${BOOTSTRAP_PACKAGE_FILE}" >&2
+      exit 1
+    fi
+    BOOTSTRAP_VALIDATION_MODE="skip"
+    echo "Bootstrap package not configured; skipping startup validation." >&2
+    return 0
+  fi
+
+  if ! python3 "${BOOTSTRAP_VALIDATOR}" \
+    --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
+    --runtime-service-origin "${PUBLIC_UPLOAD_SERVICE_URL}" \
+    --admin-did "${ADMIN_DID}" >/dev/null; then
+    echo "Bootstrap package preflight validation failed." >&2
+    exit 1
+  fi
+
+  if ! node "${BOOTSTRAP_CRYPTO_VERIFIER}" \
+    --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
+    --runtime-service-origin "${PUBLIC_UPLOAD_SERVICE_URL}" \
+    --admin-did "${ADMIN_DID}" \
+    --summary-file "${BOOTSTRAP_VERIFICATION_FILE}" >/dev/null; then
+    echo "Bootstrap delegation cryptographic preflight validation failed." >&2
+    exit 1
+  fi
+}
+
+probe_service_did() {
+  python3 - "${SERVICE_PORT}" "${VERIFY_TIMEOUT_SECONDS}" "${VERIFY_INTERVAL_SECONDS}" <<'PY'
+import json
+import sys
+import time
+import urllib.error
+import urllib.request
+
+port = int(sys.argv[1])
+timeout_seconds = float(sys.argv[2])
+interval_seconds = float(sys.argv[3])
+url = f"http://127.0.0.1:{port}/.well-known/did.json"
+deadline = time.monotonic() + timeout_seconds
+last_error = None
+
+while time.monotonic() < deadline:
+    try:
+        with urllib.request.urlopen(url, timeout=5) as response:
+            payload = json.loads(response.read().decode("utf-8"))
+        did = payload.get("id")
+        if isinstance(did, str) and did.strip():
+            print(did.strip())
+            raise SystemExit(0)
+        last_error = "did.json missing id"
+    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as error:
+        last_error = str(error)
+    time.sleep(interval_seconds)
+
+raise SystemExit(last_error or "service DID probe timed out")
+PY
+}
+
+trap terminate_child EXIT INT TERM
+validate_bootstrap_preflight
+
+"${APP_BINARY}" "$@" &
+APP_PID="$!"
+
+if [ "${BOOTSTRAP_VALIDATION_MODE}" = "enforce" ]; then
+  SERVICE_DID="$(probe_service_did)"
+  RUNTIME_SERVICE_ORIGIN=""
+  if [ -n "${PUBLIC_UPLOAD_SERVICE_URL}" ]; then
+    RUNTIME_SERVICE_ORIGIN="$(python3 - <<'PY'
+import os
+from urllib.parse import urlsplit
+
+value = os.environ.get("PUBLIC_UPLOAD_SERVICE_URL", "").strip()
+parts = urlsplit(value)
+if parts.scheme and parts.netloc:
+    print(f"{parts.scheme}://{parts.netloc}")
+PY
+)"
+  fi
+  python3 "${BOOTSTRAP_VALIDATOR}" \
+    --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
+    --runtime-service-did "${SERVICE_DID}" \
+    --runtime-service-origin "${RUNTIME_SERVICE_ORIGIN}" \
+    --admin-did "${ADMIN_DID}" >/dev/null
+  node "${BOOTSTRAP_CRYPTO_VERIFIER}" \
+    --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
+    --runtime-service-did "${SERVICE_DID}" \
+    --runtime-service-origin "${RUNTIME_SERVICE_ORIGIN}" \
+    --admin-did "${ADMIN_DID}" \
+    --summary-file "${BOOTSTRAP_VERIFICATION_FILE}" >/dev/null
+fi
+
+node "${REQUEST_GUARD}" &
+GUARD_PID="$!"
+
+set +e
+wait -n "${APP_PID}" "${GUARD_PID}"
+STATUS="$?"
+set -e
+terminate_child
+exit "${STATUS}"

package/reference/ucan-store/rootfs/ucan-store-setup-server.py

@@ -0,0 +1,229 @@
+#!/usr/bin/env python3
+import json
+import os
+import subprocess
+import tempfile
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import urlsplit
+
+
+ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/ucan-store")
+READY_FILE = os.environ.get("READY_FILE", "/etc/default/ucan-store.ready")
+SERVICE_NAME = os.environ.get("SERVICE_NAME", "ucan-store.service")
+BOOTSTRAP_SERVICE = os.environ.get("BOOTSTRAP_SERVICE", "ucan-store-bootstrap.service")
+CONFIGURE_SCRIPT = "/usr/local/sbin/ucan-store-configure.sh"
+DESCRIBE_SCRIPT = "/usr/local/sbin/ucan-store-describe.py"
+METADATA_FILE = os.environ.get("METADATA_FILE", "/run/ucan-store-setup-metadata.json")
+METADATA_ERROR_FILE = os.environ.get("METADATA_ERROR_FILE", "/run/ucan-store-setup-metadata.error")
+
+
+def _cors_headers(handler: BaseHTTPRequestHandler) -> None:
+    handler.send_header("Access-Control-Allow-Origin", "*")
+    handler.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+    handler.send_header("Access-Control-Allow-Headers", "content-type")
+
+
+def _clear_metadata_state() -> None:
+    for path in (METADATA_FILE, METADATA_ERROR_FILE):
+        try:
+            os.remove(path)
+        except FileNotFoundError:
+            pass
+
+
+def _generate_metadata_files() -> None:
+    try:
+        describe = subprocess.run(
+            [DESCRIBE_SCRIPT],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+        payload = json.loads(describe.stdout.strip() or "{}")
+        with open(METADATA_FILE, "w", encoding="utf-8") as handle:
+            json.dump(payload, handle)
+    except (subprocess.CalledProcessError, json.JSONDecodeError) as error:
+        with open(METADATA_ERROR_FILE, "w", encoding="utf-8") as handle:
+            handle.write(str(error))
+
+
+def _stop_bootstrap_service() -> None:
+    subprocess.run(["systemctl", "stop", BOOTSTRAP_SERVICE], check=False)
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "UcanStoreSetup/1.0"
+
+    def _request_path(self) -> str:
+        return urlsplit(self.path).path
+
+    def _send_json(self, status: int, payload: dict) -> None:
+        body = json.dumps(payload).encode("utf-8")
+        self.send_response(status)
+        _cors_headers(self)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, format: str, *args) -> None:  # noqa: A003
+        return
+
+    def do_OPTIONS(self) -> None:  # noqa: N802
+        self.send_response(204)
+        _cors_headers(self)
+        self.end_headers()
+
+    def do_GET(self) -> None:  # noqa: N802
+        if self._request_path() == "/metadata":
+            self._handle_metadata()
+            return
+
+        if self._request_path() not in ("/", "/health"):
+            self._send_json(404, {"status": "not-found"})
+            return
+
+        self._send_json(
+            200,
+            {
+                "status": "waiting-for-service-config",
+                "ready": os.path.exists(READY_FILE),
+                "env_file": ENV_FILE,
+                "metadata_ready": os.path.exists(METADATA_FILE),
+            },
+        )
+
+    def _handle_metadata(self) -> None:
+        if os.path.exists(METADATA_FILE):
+            with open(METADATA_FILE, encoding="utf-8") as handle:
+                metadata = json.load(handle)
+            self._send_json(200, {"status": "ready", "metadata": metadata})
+            threading.Thread(target=self.server.shutdown, daemon=True).start()  # type: ignore[arg-type]
+            threading.Thread(target=_stop_bootstrap_service, daemon=True).start()
+            return
+
+        if os.path.exists(METADATA_ERROR_FILE):
+            with open(METADATA_ERROR_FILE, encoding="utf-8") as handle:
+                error_message = handle.read().strip() or "metadata generation failed"
+            self._send_json(500, {"status": "error", "error": error_message})
+            threading.Thread(target=self.server.shutdown, daemon=True).start()  # type: ignore[arg-type]
+            threading.Thread(target=_stop_bootstrap_service, daemon=True).start()
+            return
+
+        self._send_json(202, {"status": "pending"})
+
+    def do_POST(self) -> None:  # noqa: N802
+        if self._request_path() != "/configure":
+            self._send_json(404, {"status": "not-found"})
+            return
+
+        try:
+            content_length = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            self._send_json(400, {"status": "bad-request", "error": "Invalid Content-Length"})
+            return
+
+        try:
+            payload = json.loads(self.rfile.read(content_length).decode("utf-8") or "{}")
+        except json.JSONDecodeError as error:
+            self._send_json(400, {"status": "bad-request", "error": f"Invalid JSON body: {error}"})
+            return
+
+        public_ipv4 = str(payload.get("public_ipv4") or "").strip()
+        public_ipv6 = str(payload.get("public_ipv6") or "").strip()
+        proxy_candidate = str(payload.get("proxy_url") or "").strip()
+        parsed_proxy = urlsplit(
+            proxy_candidate if "://" in proxy_candidate else f"https://{proxy_candidate}"
+        ) if proxy_candidate else None
+        proxy_hostname = parsed_proxy.hostname if parsed_proxy and parsed_proxy.hostname else proxy_candidate
+        admin_did = str(payload.get("admin_did") or "").strip()
+        webauthn_origin = str(payload.get("webauthn_origin") or "").strip()
+        webauthn_origin_fallbacks = str(payload.get("webauthn_origin_fallbacks") or "").strip()
+        no_start = bool(payload.get("no_start"))
+        bootstrap_package = payload.get("bootstrap_package")
+
+        if not public_ipv4:
+            self._send_json(400, {"status": "bad-request", "error": "public_ipv4 is required"})
+            return
+        if bootstrap_package not in (None, "") and not isinstance(bootstrap_package, dict):
+            self._send_json(
+                400,
+                {"status": "bad-request", "error": "bootstrap_package must be a JSON object when provided"},
+            )
+            return
+
+        args = [
+            CONFIGURE_SCRIPT,
+            "--public-ipv4",
+            public_ipv4,
+        ]
+        bootstrap_package_file = None
+        if public_ipv6:
+            args.extend(["--public-ipv6", public_ipv6])
+        if proxy_hostname:
+            args.extend(["--proxy-hostname", proxy_hostname])
+        if admin_did:
+            args.extend(["--admin-did", admin_did])
+        if webauthn_origin:
+            args.extend(["--webauthn-origin", webauthn_origin])
+        if webauthn_origin_fallbacks:
+            args.extend(["--webauthn-origin-fallbacks", webauthn_origin_fallbacks])
+        if isinstance(bootstrap_package, dict):
+            with tempfile.NamedTemporaryFile(
+                mode="w",
+                encoding="utf-8",
+                prefix="ucan-store-bootstrap-",
+                suffix=".json",
+                dir="/run",
+                delete=False,
+            ) as handle:
+                json.dump(bootstrap_package, handle)
+                bootstrap_package_file = handle.name
+            args.extend(["--bootstrap-package-file", bootstrap_package_file])
+        if no_start:
+            args.append("--no-start")
+
+        try:
+            result = subprocess.run(
+                args,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+        except subprocess.CalledProcessError as error:
+            self._send_json(
+                500,
+                {
+                    "status": "error",
+                    "error": error.stderr.strip() or error.stdout.strip() or str(error),
+                },
+            )
+            return
+        finally:
+            if bootstrap_package_file:
+                try:
+                    os.remove(bootstrap_package_file)
+                except FileNotFoundError:
+                    pass
+
+        _clear_metadata_state()
+        threading.Thread(target=_generate_metadata_files, daemon=True).start()
+
+        self._send_json(
+            200,
+            {
+                "status": "configured",
+                "stdout": result.stdout.strip(),
+                "metadata_pending": True,
+            },
+        )
+
+
+def main() -> None:
+    server = ThreadingHTTPServer(("0.0.0.0", 80), Handler)
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()

package/reference/ucan-store/rootfs/ucan-store-upload-api-context.js

@@ -0,0 +1,108 @@
+import * as Signer from '@ucanto/principal/ed25519';
+import * as AggregatorCaps from '@storacha/capabilities/filecoin/aggregator';
+import {
+  getConnection,
+  getMockService,
+  getStoreImplementations as getFilecoinStoreImplementations,
+  getQueueImplementations as getFilecoinQueueImplementations,
+} from '@storacha/filecoin-api/test/context/service';
+import * as Email from '../../utils/email.js';
+import { create as createRevocationChecker } from '../../utils/revocation.js';
+import { createServer, connect } from '../../lib.js';
+import { confirmConfirmationUrl } from './utils.js';
+import { getServiceStorageImplementations } from '../storage/index.js';
+import { getExternalServiceImplementations } from '../external-service/index.js';
+import { createServiceIdentity } from './ucan-store-service-identity.js';
+
+export const createContext = async (options = { requirePaymentPlan: false }) => {
+  const requirePaymentPlan = options.requirePaymentPlan;
+  const { id: serviceSigner } = await createServiceIdentity(process.env);
+  const aggregatorSigner = await Signer.generate();
+  const dealTrackerSigner = await Signer.generate();
+  const service = getMockService();
+  const aggregatorServiceProof = await AggregatorCaps.pieceOffer.delegate({
+    issuer: aggregatorSigner,
+    audience: serviceSigner,
+    with: aggregatorSigner.did(),
+    expiration: Infinity,
+  });
+  const dealTrackerConnection = getConnection(dealTrackerSigner, service).connection;
+  const serviceStores = await getServiceStorageImplementations(options);
+  const queuedMessages = new Map();
+  const {
+    storefront: { filecoinSubmitQueue, pieceOfferQueue },
+  } = getFilecoinQueueImplementations(queuedMessages);
+  const {
+    storefront: { pieceStore, receiptStore, taskStore },
+  } = getFilecoinStoreImplementations();
+  const email = Email.debug();
+  const externalServices = await getExternalServiceImplementations({
+    ...options,
+    serviceID: serviceSigner,
+  });
+  const serviceContext = {
+    id: serviceSigner,
+    signer: serviceSigner,
+    email,
+    requirePaymentPlan,
+    url: new URL('http://localhost:8787'),
+    ...serviceStores,
+    ...externalServices,
+    getServiceConnection: () => connection,
+    ...createRevocationChecker({
+      revocationsStorage: serviceStores.revocationsStorage,
+    }),
+    errorReporter: {
+      catch(error) {
+        if (options.assert) {
+          options.assert.fail(error);
+        } else {
+          throw error;
+        }
+      },
+    },
+    filecoinSubmitQueue,
+    pieceOfferQueue,
+    pieceStore,
+    receiptStore,
+    taskStore,
+    aggregatorInvocationConfig: {
+      issuer: serviceSigner,
+      with: serviceSigner.did(),
+      audience: aggregatorSigner,
+      proofs: [aggregatorServiceProof],
+    },
+    dealTrackerService: {
+      connection: dealTrackerConnection,
+      invocationConfig: {
+        issuer: serviceSigner,
+        with: serviceSigner.did(),
+        audience: dealTrackerSigner,
+      },
+    },
+    maxUploadSize: 5_000_000_000,
+  };
+  const connection = connect({
+    id: serviceContext.id,
+    channel: createServer(serviceContext),
+  });
+  return {
+    ...serviceContext,
+    ...serviceStores,
+    ...externalServices,
+    mail: serviceContext.email,
+    service: serviceContext.id,
+    connection,
+    grantAccess: (mail) => confirmConfirmationUrl(connection, mail),
+    fetch,
+  };
+};
+
+export const cleanupContext = (context) =>
+  Promise.all([
+    context.carStoreBucket.deactivate(),
+    context.blobsStorage.deactivate(),
+    context.indexingService.deactivate(),
+    context.claimsService.deactivate(),
+    ...context.storageProviders.map((provider) => provider.deactivate()),
+  ]);

package/reference/ucan-store/rootfs/ucan-store-upload-api-service-identity.js

@@ -0,0 +1,116 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import * as Signer from '@ucanto/principal/ed25519';
+
+const DEFAULT_SIGNER_FILE = '/var/lib/ucan-store/service-ed25519.key';
+const DEFAULT_ALGORITHM = 'ed25519';
+
+const normalizeString = (value) => (typeof value === 'string' ? value.trim() : '');
+
+const parseUrlLike = (value) => {
+  const normalized = normalizeString(value);
+  if (!normalized) {
+    return null;
+  }
+
+  try {
+    return new URL(normalized);
+  } catch {
+    try {
+      return new URL(`https://${normalized}`);
+    } catch {
+      return null;
+    }
+  }
+};
+
+const didWebFromUrlLike = (value) => {
+  const parsed = parseUrlLike(value);
+  if (!parsed || !parsed.hostname) {
+    return '';
+  }
+
+  const host = parsed.hostname.toLowerCase();
+  const port = parsed.port ? `%3A${parsed.port}` : '';
+  return `did:web:${host}${port}`;
+};
+
+const resolveServiceDid = (env, signer) => {
+  const explicitDid =
+    normalizeString(env.UCAN_STORE_SERVICE_DID) ||
+    normalizeString(env.PUBLIC_UPLOAD_SERVICE_DID);
+  if (explicitDid) {
+    return explicitDid;
+  }
+
+  const hostnameDid = didWebFromUrlLike(env.PROXY_HOSTNAME);
+  if (hostnameDid) {
+    return hostnameDid;
+  }
+
+  const publicUrlDid = didWebFromUrlLike(env.PUBLIC_UPLOAD_SERVICE_URL);
+  if (publicUrlDid) {
+    return publicUrlDid;
+  }
+
+  return signer.did();
+};
+
+const writeSignerFile = async (signerFile, signer) => {
+  const parentDir = path.dirname(signerFile);
+  const encoded = `${Signer.format(signer)}\n`;
+  const tempFile = `${signerFile}.tmp-${process.pid}-${Date.now()}`;
+
+  await fs.mkdir(parentDir, { recursive: true });
+  await fs.writeFile(tempFile, encoded, { mode: 0o600 });
+  await fs.rename(tempFile, signerFile);
+};
+
+export const loadOrCreateServiceSigner = async (env = process.env) => {
+  const algorithm = normalizeString(env.UCAN_STORE_SERVICE_KEY_ALGORITHM) || DEFAULT_ALGORITHM;
+  if (algorithm !== DEFAULT_ALGORITHM) {
+    throw new Error(
+      `Unsupported UCAN store service signer algorithm: ${algorithm}. Only ${DEFAULT_ALGORITHM} is currently supported.`
+    );
+  }
+
+  const signerFile = normalizeString(env.UCAN_STORE_SERVICE_SIGNER_FILE) || DEFAULT_SIGNER_FILE;
+
+  try {
+    const existing = normalizeString(await fs.readFile(signerFile, 'utf8'));
+    if (!existing) {
+      throw new Error(`Service signer file is empty: ${signerFile}`);
+    }
+    return {
+      signer: Signer.parse(existing),
+      signerFile,
+      algorithm,
+      created: false,
+    };
+  } catch (error) {
+    if (error?.code !== 'ENOENT') {
+      throw error;
+    }
+  }
+
+  const signer = await Signer.generate();
+  await writeSignerFile(signerFile, signer);
+  return {
+    signer,
+    signerFile,
+    algorithm,
+    created: true,
+  };
+};
+
+export const createServiceIdentity = async (env = process.env) => {
+  const { signer, signerFile, algorithm, created } = await loadOrCreateServiceSigner(env);
+  const serviceDid = resolveServiceDid(env, signer);
+  return {
+    signer,
+    id: serviceDid === signer.did() ? signer : signer.withDID(serviceDid),
+    signerFile,
+    algorithm,
+    created,
+  };
+};

package/reference/ucan-store/rootfs/ucan-store.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=ucan-store upload service
+Wants=network-online.target
+After=network-online.target
+ConditionPathExists=/etc/default/ucan-store.ready
+
+[Service]
+Type=simple
+User=ucan-store
+Group=ucan-store
+WorkingDirectory=/opt/ucan-store
+EnvironmentFile=-/etc/default/ucan-store
+ExecStart=/usr/local/sbin/ucan-store-service-start.sh
+Restart=always
+RestartSec=5
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target