feat(deploy): systemd units for a bare-metal turnstone-server node

Hardened service + slice + node-identity drop-in template + a README for
running a turnstone-server outside Docker that joins the compose cluster —
the production-shaped counterpart to the one-liner in docs/docker.md. Secrets
stay in config.toml; per-host identity + cluster URLs go in the drop-in. The
README notes the cross-host mTLS caveat (turnstonelabs/lacme#22).
This commit is contained in:
Patrick Buckley
2026-06-15 03:39:34 -07:00
parent 1f61350545
commit 04b3a3abe4
5 changed files with 200 additions and 0 deletions
+3
View File
@@ -110,6 +110,9 @@ box's own IP (the address the console dials back). **Set a strong
user account + API-token hash in it), the console API, and the unauthenticated
SearxNG to your network.
To run the bare-metal node as a hardened, persistent service instead of by hand,
use the systemd units in [`deploy/systemd/`](../deploy/systemd/).
## Production stack
For a real deployment use the bundled stack, which pulls released images