diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2026-03-06 13:50:24 +0100 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2026-03-06 16:08:40 +0100 |
| commit | 1af347391f9f54b370dfc7395464b8ed637a79ca (patch) | |
| tree | f73b1ff30c968763260c0aa0443de572c665350e /files/etc/systemd/system/geodata-import@.service | |
| parent | 8ee835b7fc9a3e3eac93a74f877b0b040d8dcb03 (diff) | |
Rename "webmap" to the less generic "geodata".
The database has uses beyond the webmap.
Cf. ca91a579770c89d25aefae220079bf336fa88dc9 in tools.
Diffstat (limited to 'files/etc/systemd/system/geodata-import@.service')
| -rw-r--r-- | files/etc/systemd/system/geodata-import@.service | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/files/etc/systemd/system/geodata-import@.service b/files/etc/systemd/system/geodata-import@.service new file mode 100644 index 0000000..7d652ea --- /dev/null +++ b/files/etc/systemd/system/geodata-import@.service @@ -0,0 +1,41 @@ +[Unit] +Description=Geodata updater service (import ‘%I’ to PostGIS) +After=postgresql.service geodata-update@%i.target +After=geodata-download@%i.service +Upholds=geodata-update@%i.target + +[Service] +User=_geodata +Group=_geodata + +Nice=15 +IOSchedulingClass=idle + +# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives +Environment=TMPDIR=/var/tmp + +Type=oneshot +ExecStart=/usr/local/bin/geodata-import \ + --cachedir=%C/geodata \ + --lockfile=%t/lock/geodata/lock \ + --lockdir-sources=%t/lock/geodata/cache \ + --mvtdir=/var/www/webmap/tiles/%I \ + --mvt-compress \ + --metadata-compress \ + -- %I + +# Hardening +NoNewPrivileges=yes +ProtectHome=yes +ProtectSystem=strict +PrivateDevices=yes +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +ReadWritePaths=%t/lock/geodata +ReadWritePaths=/var/www/webmap/tiles +PrivateTmp=yes + +[Install] +WantedBy=geodata-update@%i.target |