chore: initial project import

packaging/systemd/monitor-probe.service

@@ -0,0 +1,43 @@
+[Unit]
+Description=Monitor probe (network line quality measurement origin)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=exec
+User=monitor
+Group=monitor
+ExecStart=/usr/lib/monitor/monitor-probe --config /etc/monitor/probe.json
+Restart=always
+RestartSec=5
+
+# The probe is a pure collector: it never starts processes and writes no measurement data.
+# The only file the probe writes is agents.json (the latest agent list) next to probe.json.
+ReadWritePaths=/etc/monitor
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+LockPersonality=yes
+# NativeAOT does not JIT, so writable+executable memory is never needed.
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+# No capabilities needed: the probe only dials out.
+CapabilityBoundingSet=
+
+MemoryMax=64M
+TasksMax=64
+LimitNOFILE=4096
+
+[Install]
+WantedBy=multi-user.target