@le-space/rootfs 0.6.28 → 0.6.30

package/README.md

@@ -11,6 +11,8 @@ Shared rootfs contract parsing, reference profile assets, and build helpers.
   including the delayed first-start, setup endpoint, Caddy, and AutoTLS flow
 - added a `ucan-store` reference contract scaffold with documented service
   ports and consumer env expectations
+- added an ephemeral `playwright-runner` profile with Node.js 24, exact
+  Playwright/Chromium `1.61.1`, authenticated WSS, bounded logs, and a guest TTL
 
 ## Reference assets
 
@@ -22,3 +24,5 @@ Current shared reference profiles live under:
 - `reference/orbitdb-relay/rootfs/*`
 - `reference/ucan-store/contract.json`
 - `reference/ucan-store/rootfs/*`
+- `reference/playwright-runner/contract.json`
+- `reference/playwright-runner/rootfs/*`

package/index.d.ts

@@ -123,6 +123,7 @@ interface RootfsManifest {
     rootfsSizeMiB: number;
     createdAt: string;
     notes: string;
+    playwrightVersion?: string;
 }
 interface RootfsManifestOptions {
     createdAt?: string;

package/index.js

@@ -274,6 +274,9 @@ function validateRootfsManifest(manifest) {
     return { manifest, valid: false, errors: ["Rootfs manifest is missing."] };
   }
   if (!manifest.version) errors.push("Rootfs manifest version is missing.");
+  if (manifest.profile === "playwright-runner" && !/^\d+\.\d+\.\d+$/u.test(manifest.playwrightVersion ?? "")) {
+    errors.push("Playwright runner manifest must expose an exact Playwright version.");
+  }
   if (manifest.rootfsInstallStrategy != null && manifest.rootfsInstallStrategy !== "thin" && manifest.rootfsInstallStrategy !== "prebaked") {
     errors.push('Rootfs install strategy must be "thin" or "prebaked" when provided.');
   }
@@ -345,6 +348,9 @@ function createRootfsManifest(plan, contract, options = {}) {
     createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     notes: contract.manifest.notes ?? ""
   };
+  if (contract.rootfs.profile === "playwright-runner") {
+    manifest.playwrightVersion = "1.61.1";
+  }
   if (typeof options.rootfsSourceSizeBytes === "number" && Number.isFinite(options.rootfsSourceSizeBytes) && options.rootfsSourceSizeBytes > 0) {
     manifest.rootfsSourceSizeBytes = options.rootfsSourceSizeBytes;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.28",
+  "version": "0.6.30",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay/rootfs/build-rootfs-image.sh

@@ -243,6 +243,7 @@ case "${ROOTFS_PROFILE}" in
       --copy-in "${SCRIPT_DIR}/orbitdb-relay-bootstrap.service:/etc/systemd/system"
       --copy-in "${SCRIPT_DIR}/orbitdb-relay-bootstrap-refresh.service:/etc/systemd/system"
       --copy-in "${SCRIPT_DIR}/orbitdb-relay-bootstrap-refresh.timer:/etc/systemd/system"
+      --copy-in "${SCRIPT_DIR}/orbitdb-relay-bootstrap-deregister.service:/etc/systemd/system"
       --copy-in "${SCRIPT_DIR}/orbitdb-relay-autotls-refresh.service:/etc/systemd/system"
       --copy-in "${SCRIPT_DIR}/orbitdb-relay-bootstrap.conf:/etc/systemd/system/orbitdb-relay.service.d"
       --run-command "tar -xf /opt/$(basename "${APP_TAR}") -C /opt/orbitdb-relay"

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap-deregister.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Best-effort Aleph bootstrap deregistration on shutdown for orbitdb-relay
+After=network-online.target orbitdb-relay.service
+Wants=network-online.target
+ConditionPathExists=/etc/default/orbitdb-relay.ready
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+Environment=ENV_FILE=/etc/default/orbitdb-relay
+Environment=DESCRIBE_SCRIPT=/usr/local/sbin/orbitdb-relay-describe.py
+Environment=ALEPH_BOOTSTRAP_DEREGISTER_ONLY=1
+ExecStart=/bin/true
+ExecStop=/usr/bin/python3 /usr/local/sbin/orbitdb-relay-bootstrap-refresh.py
+StandardOutput=journal
+StandardError=journal
+TimeoutStopSec=25
+
+[Install]
+WantedBy=multi-user.target

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap-refresh.py

@@ -476,6 +476,7 @@ def fetch_previous_hashes(
     sender: str,
     current_item_hash: str,
     now_ms: int,
+    deregister_all: bool = False,
 ) -> list[str]:
     stale_cutoff_ms = now_ms - (STALE_RECORD_MAX_AGE_SECONDS * 1000)
     normalized_sender = normalize_address(sender)
@@ -503,7 +504,10 @@ def fetch_previous_hashes(
             }
             if not same_publisher:
                 continue
-            if parsed["item_hash"] == current_item_hash:
+            if not deregister_all and parsed["item_hash"] == current_item_hash:
+                continue
+            if deregister_all:
+                found.append(str(parsed["item_hash"]))
                 continue
             updated_at = timestamp_ms(parsed["updated_at"])
             if updated_at is not None and updated_at < stale_cutoff_ms:
@@ -556,6 +560,49 @@ def main() -> None:
         print(json_dumps({"status": "skipped", "reason": "missing publisher key"}))
         return
 
+    publisher_address = address_from_private_key(publisher_private_key)
+    now_ms = int(time.time() * 1000)
+    channel = env_values.get("ALEPH_BOOTSTRAP_CHANNEL", DEFAULT_CHANNEL).strip() or DEFAULT_CHANNEL
+    ref = env_values.get("ALEPH_BOOTSTRAP_REF", DEFAULT_REF).strip() or DEFAULT_REF
+    post_type = env_values.get("ALEPH_BOOTSTRAP_POST_TYPE", POST_TYPE).strip() or POST_TYPE
+    if post_type != POST_TYPE:
+        raise RuntimeError(
+            f"Unsupported ALEPH_BOOTSTRAP_POST_TYPE: {post_type}. Expected {POST_TYPE}."
+        )
+    api_host = env_values.get("ALEPH_BOOTSTRAP_API_HOST", DEFAULT_API_HOST).strip() or DEFAULT_API_HOST
+    deregister_only = os.environ.get("ALEPH_BOOTSTRAP_DEREGISTER_ONLY", "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+    }
+    if deregister_only:
+        hashes = fetch_previous_hashes(
+            api_host,
+            channel,
+            ref,
+            post_type,
+            publisher_address,
+            "",
+            now_ms,
+            deregister_all=True,
+        )
+        forget_response = broadcast_forget(
+            api_host, publisher_address, publisher_private_key, hashes, channel
+        )
+        print(
+            json_dumps(
+                {
+                    "status": "forgotten" if hashes else "skipped",
+                    "reason": None if hashes else "no matching bootstrap records",
+                    "sender": publisher_address,
+                    "registrationId": registration_id,
+                    "forgottenHashes": hashes,
+                    "forgetResponse": forget_response,
+                }
+            )
+        )
+        return
+
     describe = subprocess.run([DESCRIBE_SCRIPT], check=True, capture_output=True, text=True)
     metadata = json.loads(describe.stdout.strip() or "{}")
     peer_id = metadata.get("peer_id")
@@ -567,19 +614,9 @@ def main() -> None:
         metadata.get("browser_bootstrap_multiaddrs") or [], browser_only=True
     )
 
-    publisher_address = address_from_private_key(publisher_private_key)
-    now_ms = int(time.time() * 1000)
     now_seconds = now_ms / 1000
     profile = env_values.get("ALEPH_BOOTSTRAP_PROFILE", DEFAULT_PROFILE).strip() or DEFAULT_PROFILE
     version = env_values.get("ALEPH_BOOTSTRAP_VERSION", "").strip() or None
-    channel = env_values.get("ALEPH_BOOTSTRAP_CHANNEL", DEFAULT_CHANNEL).strip() or DEFAULT_CHANNEL
-    ref = env_values.get("ALEPH_BOOTSTRAP_REF", DEFAULT_REF).strip() or DEFAULT_REF
-    post_type = env_values.get("ALEPH_BOOTSTRAP_POST_TYPE", POST_TYPE).strip() or POST_TYPE
-    if post_type != POST_TYPE:
-        raise RuntimeError(
-            f"Unsupported ALEPH_BOOTSTRAP_POST_TYPE: {post_type}. Expected {POST_TYPE}."
-        )
-    api_host = env_values.get("ALEPH_BOOTSTRAP_API_HOST", DEFAULT_API_HOST).strip() or DEFAULT_API_HOST
     published_multiaddrs = select_compact_multiaddrs(browser_multiaddrs or multiaddrs)
     published_browser_multiaddrs: list[str] = []
     if not published_multiaddrs:

package/reference/orbitdb-relay/rootfs/orbitdb-relay-configure.sh

@@ -15,6 +15,8 @@ CADDY_UPSTREAM_HOST="${CADDY_UPSTREAM_HOST:-127.0.0.1}"
 CADDY_UPSTREAM_METRICS_PORT="${CADDY_UPSTREAM_METRICS_PORT:-9090}"
 AUTOTLS_REFRESH_SERVICE="${AUTOTLS_REFRESH_SERVICE:-orbitdb-relay-autotls-refresh.service}"
 BOOTSTRAP_REFRESH_TIMER="${BOOTSTRAP_REFRESH_TIMER:-orbitdb-relay-bootstrap-refresh.timer}"
+BOOTSTRAP_REFRESH_SERVICE="${BOOTSTRAP_REFRESH_SERVICE:-orbitdb-relay-bootstrap-refresh.service}"
+BOOTSTRAP_DEREGISTER_SERVICE="${BOOTSTRAP_DEREGISTER_SERVICE:-orbitdb-relay-bootstrap-deregister.service}"
 PUBLIC_IPV4=""
 PUBLIC_IPV6=""
 TCP_PORT=""
@@ -278,7 +280,10 @@ if [ "${START_SERVICE}" -eq 1 ]; then
   systemctl restart "${SERVICE_NAME}"
   systemctl enable "${AUTOTLS_REFRESH_SERVICE}"
   systemctl enable "${BOOTSTRAP_REFRESH_TIMER}"
+  systemctl enable "${BOOTSTRAP_DEREGISTER_SERVICE}"
+  systemctl restart "${BOOTSTRAP_DEREGISTER_SERVICE}"
   systemctl start "${BOOTSTRAP_REFRESH_TIMER}"
+  systemctl restart --no-block "${BOOTSTRAP_REFRESH_SERVICE}" || true
   if [ -n "${PROXY_HOSTNAME}" ]; then
     write_caddyfile "${PROXY_HOSTNAME}"
     touch "${CADDY_READY_FILE}"

package/reference/playwright-runner/README.md

@@ -0,0 +1,21 @@
+# Playwright runner RootFS
+
+This profile prebakes Node.js 24, Playwright `1.61.1`, its matching Chromium
+headless shell, Caddy, and systemd units. It intentionally contains no endpoint
+credential or TLS private key. The full headed Chromium bundle is omitted
+because this remote CI runner only launches headless browsers.
+
+After Aleph allocates the VM, the reusable action must inject:
+
+- `/etc/default/playwright-runner` with `PLAYWRIGHT_RUNNER_SECRET` and the exact
+  `PLAYWRIGHT_VERSION=1.61.1`;
+- a per-run certificate and key readable by the dedicated proxy service;
+- the requested TTL override, if shorter than the default 45 minutes.
+
+The bootstrap unit refuses to start the browser and proxy until those files are
+present. Caddy protects `/version` and the websocket upgrade with the same
+Bearer credential. The Playwright server only listens on `127.0.0.1:3000`.
+
+The TTL is a last-resort shutdown, not authoritative Aleph cleanup. The owner
+must still erase and FORGET the exact INSTANCE and verify scheduler
+deallocation.

package/reference/playwright-runner/contract.json

@@ -0,0 +1,40 @@
+{
+  "schemaVersion": 1,
+  "id": "playwright-runner",
+  "displayName": "Ephemeral Playwright Chromium Runner",
+  "source": {
+    "repository": "NiKrause/relay-button",
+    "subdirectory": "packages/rootfs/reference/playwright-runner"
+  },
+  "rootfs": {
+    "profile": "playwright-runner",
+    "installMode": "prebaked",
+    "installDir": "/opt/playwright-runner",
+    "binaryPath": "/opt/playwright-runner/node_modules/.bin/playwright",
+    "dataDir": "/var/lib/playwright-runner",
+    "envFile": "/etc/default/playwright-runner"
+  },
+  "services": {
+    "bootstrap": "playwright-runner-bootstrap.service",
+    "main": "playwright-runner.service",
+    "autotlsRefresh": "playwright-runner-ttl.timer"
+  },
+  "ports": [
+    {
+      "port": 22,
+      "tcp": true,
+      "udp": false,
+      "purpose": "SSH bootstrap and diagnostics"
+    },
+    {
+      "port": 443,
+      "tcp": true,
+      "udp": false,
+      "purpose": "Authenticated Playwright WSS and version endpoint"
+    }
+  ],
+  "manifest": {
+    "copyTarget": "packages/rootfs/reference/playwright-runner/latest.json",
+    "notes": "Node.js 24 and Playwright 1.61.1 with matching Chromium are prebaked. A random bearer secret and per-run TLS material must be injected after boot. The image contains no reusable credential and shuts down through a bounded TTL timer."
+  }
+}

package/reference/playwright-runner/rootfs/Caddyfile

@@ -0,0 +1,18 @@
+{
+	admin off
+	auto_https disable_redirects
+}
+
+:443 {
+	tls /etc/playwright-runner/tls.crt /etc/playwright-runner/tls.key
+
+	@unauthorized not header Authorization "Bearer {$PLAYWRIGHT_RUNNER_SECRET}"
+	respond @unauthorized 401
+
+	handle /version {
+		header Content-Type application/json
+		respond `{"playwrightVersion":"{$PLAYWRIGHT_VERSION}"}` 200
+	}
+
+	reverse_proxy 127.0.0.1:3000
+}

package/reference/playwright-runner/rootfs/Dockerfile.rootfs

@@ -0,0 +1,16 @@
+FROM debian:12
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LIBGUESTFS_BACKEND=direct
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    libguestfs-tools \
+    linux-image-amd64 \
+    qemu-system-x86 \
+    qemu-utils \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace/shared-rootfs

package/reference/playwright-runner/rootfs/build-rootfs-image.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+OUT_DIR="${OUT_DIR:-${SCRIPT_DIR}/../dist-rootfs}"
+BASE_URL="${BASE_URL:-https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2}"
+BASE_IMAGE="${OUT_DIR}/debian-12-genericcloud-amd64.qcow2"
+IMAGE="${OUT_DIR}/aleph-playwright-runner.qcow2"
+ROOTFS_IMAGE_SIZE="${ROOTFS_IMAGE_SIZE:-20G}"
+PLAYWRIGHT_VERSION="${PLAYWRIGHT_VERSION:-1.61.1}"
+HOST_UID="${HOST_UID:-}"
+HOST_GID="${HOST_GID:-}"
+ROOTFS_SPARSIFY_TMPDIR=""
+
+require() {
+  command -v "$1" >/dev/null 2>&1 || { echo "Missing required command: $1" >&2; exit 1; }
+}
+
+for command in curl qemu-img virt-customize; do require "${command}"; done
+test "${PLAYWRIGHT_VERSION}" = "1.61.1" || {
+  echo "playwright-runner only supports Playwright 1.61.1" >&2
+  exit 1
+}
+
+cleanup() {
+  if [ -n "${ROOTFS_SPARSIFY_TMPDIR}" ] && [ -d "${ROOTFS_SPARSIFY_TMPDIR}" ]; then
+    rm -rf "${ROOTFS_SPARSIFY_TMPDIR}"
+  fi
+}
+trap cleanup EXIT
+
+mkdir -p "${OUT_DIR}"
+if [ ! -f "${BASE_IMAGE}" ]; then
+  curl --fail --show-error --location --retry 5 --retry-all-errors \
+    --connect-timeout 20 --max-time 300 "${BASE_URL}" -o "${BASE_IMAGE}"
+fi
+
+cp "${BASE_IMAGE}" "${IMAGE}"
+qemu-img resize "${IMAGE}" "${ROOTFS_IMAGE_SIZE}"
+
+virt-customize \
+  -a "${IMAGE}" \
+  --network \
+  --mkdir /opt/playwright-runner \
+  --mkdir /opt/playwright-browsers \
+  --mkdir /etc/playwright-runner \
+  --mkdir /etc/systemd/journald.conf.d \
+  --mkdir /var/lib/playwright-runner \
+  --copy-in "${SCRIPT_DIR}/Caddyfile:/etc/playwright-runner" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-bootstrap.sh:/usr/local/sbin" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner.service:/etc/systemd/system" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-proxy.service:/etc/systemd/system" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-bootstrap.service:/etc/systemd/system" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-ttl.service:/etc/systemd/system" \
+  --copy-in "${SCRIPT_DIR}/playwright-runner-ttl.timer:/etc/systemd/system" \
+  --run-command "apt-get update && apt-get install -y --no-install-recommends ca-certificates caddy curl gnupg" \
+  --run-command "curl -fsSL https://deb.nodesource.com/setup_24.x | bash -" \
+  --run-command "apt-get install -y --no-install-recommends nodejs" \
+  --run-command "useradd --system --home /var/lib/playwright-runner --shell /usr/sbin/nologin playwright-runner" \
+  --run-command "useradd --system --home /var/lib/playwright-runner --shell /usr/sbin/nologin playwright-proxy" \
+  --run-command "cd /opt/playwright-runner && npm init -y && npm install --omit=dev --no-audit --no-fund playwright@${PLAYWRIGHT_VERSION}" \
+  --run-command "cd /opt/playwright-runner && PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers ./node_modules/.bin/playwright install --with-deps --only-shell chromium" \
+  --run-command "chown -R playwright-runner:playwright-runner /opt/playwright-runner /opt/playwright-browsers /var/lib/playwright-runner" \
+  --run-command "chown -R root:playwright-proxy /etc/playwright-runner && chmod 0750 /etc/playwright-runner" \
+  --run-command "chmod 0755 /usr/local/sbin/playwright-runner-bootstrap.sh" \
+  --run-command "printf '[Journal]\\nSystemMaxUse=128M\\nRuntimeMaxUse=64M\\nMaxRetentionSec=2day\\n' >/etc/systemd/journald.conf.d/playwright-runner.conf" \
+  --run-command "npm cache clean --force" \
+  --run-command "apt-get clean && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* /root/.npm /tmp/* /var/tmp/*" \
+  --run-command "systemctl enable playwright-runner-bootstrap.service"
+
+if command -v virt-sparsify >/dev/null 2>&1; then
+  SPARSE_IMAGE="${IMAGE%.qcow2}.sparse.qcow2"
+  ROOTFS_SPARSIFY_TMPDIR="$(mktemp -d "${OUT_DIR}/virt-sparsify-tmp.XXXXXX")"
+  TMPDIR="${ROOTFS_SPARSIFY_TMPDIR}" virt-sparsify --check-tmpdir=continue --compress \
+    "${IMAGE}" "${SPARSE_IMAGE}"
+  mv "${SPARSE_IMAGE}" "${IMAGE}"
+fi
+
+if [ -n "${HOST_UID}" ] && [ -n "${HOST_GID}" ]; then
+  chown -R "${HOST_UID}:${HOST_GID}" "${OUT_DIR}"
+fi
+
+echo "Compressed RootFS size: $(stat -c '%s bytes' "${IMAGE}") ($(du -h "${IMAGE}" | cut -f1) on disk)"
+echo "Playwright ${PLAYWRIGHT_VERSION} RootFS ready: ${IMAGE}"

package/reference/playwright-runner/rootfs/playwright-runner-bootstrap.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Validate and start the injected Playwright runner configuration
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/etc/default/playwright-runner
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/playwright-runner-bootstrap.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

package/reference/playwright-runner/rootfs/playwright-runner-bootstrap.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENV_FILE=/etc/default/playwright-runner
+TLS_CERT=/etc/playwright-runner/tls.crt
+TLS_KEY=/etc/playwright-runner/tls.key
+
+test -s "${ENV_FILE}"
+test -s "${TLS_CERT}"
+test -s "${TLS_KEY}"
+
+set -a
+# shellcheck disable=SC1090
+source "${ENV_FILE}"
+set +a
+
+test "${PLAYWRIGHT_VERSION:-}" = "1.61.1"
+test -n "${PLAYWRIGHT_RUNNER_SECRET:-}"
+
+chown root:playwright-proxy "${TLS_CERT}" "${TLS_KEY}"
+chmod 0644 "${TLS_CERT}"
+chmod 0640 "${TLS_KEY}"
+
+systemctl restart playwright-runner.service
+systemctl restart playwright-runner-proxy.service
+systemctl restart playwright-runner-ttl.timer

package/reference/playwright-runner/rootfs/playwright-runner-proxy.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=Authenticated TLS proxy for the Playwright runner
+After=network-online.target playwright-runner.service
+Requires=playwright-runner.service
+ConditionPathExists=/etc/default/playwright-runner
+ConditionPathExists=/etc/playwright-runner/tls.crt
+ConditionPathExists=/etc/playwright-runner/tls.key
+
+[Service]
+Type=simple
+User=playwright-proxy
+Group=playwright-proxy
+EnvironmentFile=/etc/default/playwright-runner
+ExecStart=/usr/bin/caddy run --config /etc/playwright-runner/Caddyfile --adapter caddyfile
+ExecReload=/usr/bin/caddy reload --config /etc/playwright-runner/Caddyfile --adapter caddyfile
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

package/reference/playwright-runner/rootfs/playwright-runner-ttl.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Stop an expired ephemeral Playwright runner
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/systemctl poweroff

package/reference/playwright-runner/rootfs/playwright-runner-ttl.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Maximum lifetime for an ephemeral Playwright runner
+
+[Timer]
+OnActiveSec=45min
+AccuracySec=1min
+Unit=playwright-runner-ttl.service
+
+[Install]
+WantedBy=timers.target

package/reference/playwright-runner/rootfs/playwright-runner.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Ephemeral Playwright 1.61.1 browser server
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/etc/default/playwright-runner
+
+[Service]
+Type=simple
+User=playwright-runner
+Group=playwright-runner
+EnvironmentFile=/etc/default/playwright-runner
+Environment=PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers
+WorkingDirectory=/opt/playwright-runner
+ExecStart=/opt/playwright-runner/node_modules/.bin/playwright run-server --host 127.0.0.1 --port 3000
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/playwright-runner
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

package/reference/uc-go-peer/rootfs/uc-go-peer-bootstrap-deregister.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=Best-effort Aleph bootstrap deregistration on shutdown for uc-go-peer
-After=network-online.target
+After=network-online.target uc-go-peer.service
 Wants=network-online.target
 ConditionPathExists=/etc/default/uc-go-peer.ready