feat: add legacy sidecar service and PKGBUILD distro split

Legacy distros (rocky_8, ubuntu_jammy) get the sidecar with
consul connect envoy directly and WantedBy=multi-user.target.
Modern distros use service-discover-wrapper.sh with Type=notify
and PartOf=service-discover.target.

Refs: CO-3422

Author: M0Rf30

package/PKGBUILD

@@ -23,6 +23,7 @@ source=(
   "carbonio-ws-collaboration-db.hcl"
   "carbonio-ws-collaboration-db-bootstrap"
   "carbonio-ws-collaboration-db-sidecar.service"
+  "carbonio-ws-collaboration-db-sidecar-legacy.service"
   "intentions.json"
   "policies.json"
   "service-protocol.json"
@@ -33,23 +34,37 @@ sha256sums=(
   '59a74fcfbbfaf4628271bfa4d4e76c46d508f7b21d3a79d46ad51f96b8083695'
   'cbcdea3b53ed934a0e4280be9ab3434118a8c096c81a9cc68f007ff59f68520f'
   '6ed3ab14e72e4de771b13eee2971c57c15df97882b3a1926b333b3c357510869'
+  'd1fc1d459676c52bf147204fcc9145143a9d79937dad407d22fe666b6d3ca1d3'
   '87b5d43d577bd805a74aa5f38ded4cc5a755ba35ab8266c8f3b60f3a091a07c3'
   '9bedfb38742c72034f015aee3f1e7bdb734cd5d6e0003b109a8d6fead4962a8c'
   'd0f4019f14ff13fe5d394e9945c6679c1098f532c8bffd41b129e1a804947ac1'
 )
 
-package() {
+_package_common() {
   cd "${srcdir}"
   install -Dm 644 111-carbonio-ws-collaboration-db-setup.sh "${pkgdir}/etc/zextras/pending-setups.d/111-carbonio-ws-collaboration-db-setup.sh"
   install -Dm 755 carbonio-ws-collaboration-db "${pkgdir}/usr/bin/carbonio-ws-collaboration-db"
-  install -Dm 644 carbonio-ws-collaboration-db-sidecar.service "${pkgdir}/lib/systemd/system/carbonio-ws-collaboration-db-sidecar.service"
   install -Dm 644 carbonio-ws-collaboration-db.hcl "${pkgdir}/etc/zextras/service-discover/carbonio-ws-collaboration-db.hcl"
   install -Dm 755 carbonio-ws-collaboration-db-bootstrap "${pkgdir}/usr/bin/carbonio-ws-collaboration-db-bootstrap"
   install -Dm 644 intentions.json "${pkgdir}/etc/carbonio/ws-collaboration-db/service-discover/intentions.json"
   install -Dm 644 policies.json "${pkgdir}/etc/carbonio/ws-collaboration-db/service-discover/policies.json"
   install -Dm 644 service-protocol.json "${pkgdir}/etc/carbonio/ws-collaboration-db/service-discover/service-protocol.json"
 }
 
+_package_systemd() {
+  _package_common
+  install -Dm 644 carbonio-ws-collaboration-db-sidecar.service "${pkgdir}/lib/systemd/system/carbonio-ws-collaboration-db-sidecar.service"
+}
+
+_package_legacy() {
+  _package_common
+  install -Dm 644 carbonio-ws-collaboration-db-sidecar-legacy.service "${pkgdir}/lib/systemd/system/carbonio-ws-collaboration-db-sidecar.service"
+}
+
+package() { _package_systemd; }
+package__rocky_8() { _package_legacy; }
+package__ubuntu_jammy() { _package_legacy; }
+
 postinst() {
   getent group 'carbonio-ws-collaboration-db' >/dev/null ||
     groupadd -r 'carbonio-ws-collaboration-db'
@@ -59,6 +74,7 @@ postinst() {
   if [ -d /run/systemd/system ]; then
     systemctl daemon-reload >/dev/null 2>&1 || :
     systemctl enable carbonio-ws-collaboration-db-sidecar.service >/dev/null 2>&1 || :
+  "carbonio-ws-collaboration-db-sidecar-legacy.service"
   fi
 
   echo "============================================================"
@@ -70,7 +86,9 @@ postinst() {
 prerm() {
   if [ -d /run/systemd/system ]; then
     systemctl --no-reload disable carbonio-ws-collaboration-db-sidecar.service >/dev/null 2>&1 || :
+  "carbonio-ws-collaboration-db-sidecar-legacy.service"
     systemctl stop carbonio-ws-collaboration-db-sidecar.service >/dev/null 2>&1 || :
+  "carbonio-ws-collaboration-db-sidecar-legacy.service"
   fi
 }
 

package/carbonio-ws-collaboration-db-sidecar-legacy.service

@@ -0,0 +1,39 @@
+[Unit]
+Description=Carbonio WS Collaboration DB Sidecar
+Documentation=https://docs.zextras.com/
+Requires=network-online.target
+After=network-online.target
+
+[Service]
+User=carbonio-ws-collaboration-db
+ExecStart=/usr/bin/consul connect envoy \
+    -token-file /etc/carbonio/ws-collaboration-db/service-discover/token \
+    -admin-bind localhost:0 \
+    -sidecar-for carbonio-ws-collaboration-db
+ExecReload=/usr/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=15s
+KillSignal=SIGINT
+LimitNOFILE=65536
+
+# Hardening
+PrivateTmp=yes
+ProtectSystem=strict
+NoNewPrivileges=yes
+PrivateDevices=yes
+ProtectHome=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+RestrictRealtime=yes
+RestrictNamespaces=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+ProtectHostname=yes
+ProtectClock=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+
+[Install]
+WantedBy=multi-user.target