summaryrefslogtreecommitdiffstats
path: root/files/etc/systemd/system/webmap-download@.service
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2024-09-25 19:18:15 +0200
committerGuilhem Moulin <guilhem@fripost.org>2024-09-25 21:44:41 +0200
commitf0feb7c74ca2252ef2513da12fc85be9684a54b4 (patch)
tree301152d43426ab8f242ab835fdc04e6f3ba21196 /files/etc/systemd/system/webmap-download@.service
parent5f9605745f4f8e59d5aba78da18b8a50bc4a5d88 (diff)
Copy webmap-publish.
We also replace persistent/shared RuntimeDirectory settings with directories defined as tmpfiles.d(5) entries. This gives more control over access control. We also change static compression from gzip to brotli on the HTTPd.
Diffstat (limited to 'files/etc/systemd/system/webmap-download@.service')
-rw-r--r--files/etc/systemd/system/webmap-download@.service6
1 files changed, 2 insertions, 4 deletions
diff --git a/files/etc/systemd/system/webmap-download@.service b/files/etc/systemd/system/webmap-download@.service
index c0e826f..2c5a3e4 100644
--- a/files/etc/systemd/system/webmap-download@.service
+++ b/files/etc/systemd/system/webmap-download@.service
@@ -16,14 +16,11 @@ IOSchedulingClass=idle
Type=oneshot
ExecStart=/usr/local/bin/webmap-download \
--cachedir=/var/cache/webmap \
- --lockdir=%t/webmap-download \
+ --lockdir=%t/lock/webmap/download \
--no-exit-code \
--quiet \
-- %I
-RuntimeDirectory=webmap-download
-RuntimeDirectoryPreserve=yes
-
# Hardening
NoNewPrivileges=yes
ProtectHome=yes
@@ -34,6 +31,7 @@ ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
ReadWritePaths=/var/cache/webmap
+ReadWritePaths=%t/lock/webmap/download
[Install]
WantedBy=webmap-update@%i.target