From d97b1661c1694e1eb91b6c280810b695ce269046 Mon Sep 17 00:00:00 2001
From: boris <boris+gitea@ntbx.io>
Date: Thu, 16 Apr 2026 17:27:25 +0100
Subject: [PATCH] added systemd service and installation file

---
 agent/README.md                           | 51 +++++++++++++++++++
 agent/scripts/install-systemd.sh          | 61 +++++++++++++++++++++++
 agent/systemd/keywarden-agent.env.example | 13 +++++
 agent/systemd/keywarden-agent.service     | 23 +++++++++
 4 files changed, 148 insertions(+)
 create mode 100755 agent/scripts/install-systemd.sh
 create mode 100644 agent/systemd/keywarden-agent.env.example
 create mode 100644 agent/systemd/keywarden-agent.service

diff --git a/agent/README.md b/agent/README.md
index 7f59f63..5949ded 100644
--- a/agent/README.md
+++ b/agent/README.md
@@ -20,6 +20,57 @@ To rotate/re-enroll an existing agent identity, add `-force-enroll` with a fresh
 
 You can also pass `KEYWARDEN_SERVER_URL` and `KEYWARDEN_ENROLL_TOKEN` as environment variables.
 
+## systemd service (portable)
+
+The repo includes a reusable unit file and installer:
+
+- Unit: `systemd/keywarden-agent.service`
+- Env template: `systemd/keywarden-agent.env.example`
+- Installer: `scripts/install-systemd.sh`
+
+### Quick install
+
+From this `agent/` directory:
+
+```bash
+go build -o keywarden-agent ./cmd/keywarden-agent
+sudo ./scripts/install-systemd.sh
+sudoedit /etc/default/keywarden-agent
+sudo systemctl enable --now keywarden-agent
+```
+
+### Manual install
+
+```bash
+sudo install -D -m 0755 ./keywarden-agent /usr/local/bin/keywarden-agent
+sudo install -D -m 0644 ./systemd/keywarden-agent.service /etc/systemd/system/keywarden-agent.service
+sudo install -D -m 0640 ./systemd/keywarden-agent.env.example /etc/default/keywarden-agent
+sudo mkdir -p /etc/keywarden
+sudo bash -c 'cat > /etc/keywarden/agent.json <<EOF
+{
+  "server_url": "https://keywarden.example.com/api/v1"
+}
+EOF'
+sudo chmod 0600 /etc/keywarden/agent.json
+sudo systemctl daemon-reload
+sudo systemctl enable --now keywarden-agent
+```
+
+### First boot behavior
+
+- If `/etc/keywarden/agent.json` does not exist, set `KEYWARDEN_SERVER_URL` in `/etc/default/keywarden-agent`.
+- For first enrollment, set `KEYWARDEN_ENROLL_TOKEN` in `/etc/default/keywarden-agent`.
+- After successful enrollment, `server_id` and `agent_api_token` are written to `agent.json`.
+- You can remove `KEYWARDEN_ENROLL_TOKEN` from `/etc/default/keywarden-agent` after enrollment.
+
+### Service operations
+
+```bash
+sudo systemctl status keywarden-agent
+sudo journalctl -u keywarden-agent -f
+sudo systemctl restart keywarden-agent
+```
+
 ## Config
 
 On first boot, the agent will create a config file if it does not exist. Only `server_url` is required for bootstrapping.
diff --git a/agent/scripts/install-systemd.sh b/agent/scripts/install-systemd.sh
new file mode 100755
index 0000000..4508a0b
--- /dev/null
+++ b/agent/scripts/install-systemd.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
+  echo "Run as root (or via sudo)." >&2
+  exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+AGENT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+BIN_SOURCE="${1:-${AGENT_DIR}/keywarden-agent}"
+UNIT_SOURCE="${AGENT_DIR}/systemd/keywarden-agent.service"
+ENV_SOURCE="${AGENT_DIR}/systemd/keywarden-agent.env.example"
+
+if [[ ! -f "${BIN_SOURCE}" ]]; then
+  echo "Agent binary not found: ${BIN_SOURCE}" >&2
+  echo "Build it first: go build -o keywarden-agent ./cmd/keywarden-agent" >&2
+  exit 1
+fi
+
+if [[ ! -f "${UNIT_SOURCE}" ]]; then
+  echo "Unit file not found: ${UNIT_SOURCE}" >&2
+  exit 1
+fi
+
+install -D -m 0755 "${BIN_SOURCE}" /usr/local/bin/keywarden-agent
+install -D -m 0644 "${UNIT_SOURCE}" /etc/systemd/system/keywarden-agent.service
+
+if [[ ! -f /etc/default/keywarden-agent ]]; then
+  install -D -m 0640 "${ENV_SOURCE}" /etc/default/keywarden-agent
+fi
+
+mkdir -p /etc/keywarden
+if [[ ! -f /etc/keywarden/agent.json ]]; then
+  cat > /etc/keywarden/agent.json <<'EOF'
+{
+  "server_url": "https://keywarden.example.com/api/v1"
+}
+EOF
+  chmod 0600 /etc/keywarden/agent.json
+fi
+
+systemctl daemon-reload
+
+cat <<'EOF'
+Installed:
+  - /usr/local/bin/keywarden-agent
+  - /etc/systemd/system/keywarden-agent.service
+  - /etc/default/keywarden-agent (if it did not already exist)
+  - /etc/keywarden/agent.json (bootstrap file, if it did not already exist)
+
+Next steps:
+  1) Edit /etc/default/keywarden-agent and set KEYWARDEN_SERVER_URL + KEYWARDEN_ENROLL_TOKEN.
+  2) (Optional) Edit /etc/keywarden/agent.json with additional settings.
+  3) Enable and start:
+       systemctl enable --now keywarden-agent
+  4) Check status/logs:
+       systemctl status keywarden-agent
+       journalctl -u keywarden-agent -f
+EOF
diff --git a/agent/systemd/keywarden-agent.env.example b/agent/systemd/keywarden-agent.env.example
new file mode 100644
index 0000000..b716740
--- /dev/null
+++ b/agent/systemd/keywarden-agent.env.example
@@ -0,0 +1,13 @@
+# Keywarden server URL (required on first boot if /etc/keywarden/agent.json does not exist)
+KEYWARDEN_SERVER_URL=https://keywarden.example.com/api/v1
+
+# Enrollment token used only for first enrollment / forced re-enrollment.
+# Remove after successful enrollment.
+KEYWARDEN_ENROLL_TOKEN=
+
+# Optional path to a private CA PEM for verifying the Keywarden server TLS cert.
+# KEYWARDEN_SERVER_CA_PATH=/etc/ssl/certs/keywarden-ca.pem
+
+# Optional override for the persisted per-agent token in agent.json.
+# Normally leave unset.
+# KEYWARDEN_AGENT_API_TOKEN=
diff --git a/agent/systemd/keywarden-agent.service b/agent/systemd/keywarden-agent.service
new file mode 100644
index 0000000..0c42127
--- /dev/null
+++ b/agent/systemd/keywarden-agent.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=Keywarden Agent
+Documentation=https://git.ntbx.io/boris/keywarden
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+EnvironmentFile=-/etc/default/keywarden-agent
+EnvironmentFile=-/etc/sysconfig/keywarden-agent
+ExecStart=/usr/local/bin/keywarden-agent -config /etc/keywarden/agent.json
+Restart=always
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+
+[Install]
+WantedBy=multi-user.target