diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2024-09-25 19:18:15 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2024-09-25 21:44:41 +0200 |
| commit | f0feb7c74ca2252ef2513da12fc85be9684a54b4 (patch) | |
| tree | 301152d43426ab8f242ab835fdc04e6f3ba21196 /files/etc/systemd/system/webmap-download@.service | |
| parent | 5f9605745f4f8e59d5aba78da18b8a50bc4a5d88 (diff) | |
Copy webmap-publish.
We also replace persistent/shared RuntimeDirectory settings with
directories defined as tmpfiles.d(5) entries. This gives more control
over access control.
We also change static compression from gzip to brotli on the HTTPd.
Diffstat (limited to 'files/etc/systemd/system/webmap-download@.service')
| -rw-r--r-- | files/etc/systemd/system/webmap-download@.service | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/files/etc/systemd/system/webmap-download@.service b/files/etc/systemd/system/webmap-download@.service index c0e826f..2c5a3e4 100644 --- a/files/etc/systemd/system/webmap-download@.service +++ b/files/etc/systemd/system/webmap-download@.service @@ -16,14 +16,11 @@ IOSchedulingClass=idle Type=oneshot ExecStart=/usr/local/bin/webmap-download \ --cachedir=/var/cache/webmap \ - --lockdir=%t/webmap-download \ + --lockdir=%t/lock/webmap/download \ --no-exit-code \ --quiet \ -- %I -RuntimeDirectory=webmap-download -RuntimeDirectoryPreserve=yes - # Hardening NoNewPrivileges=yes ProtectHome=yes @@ -34,6 +31,7 @@ ProtectKernelModules=yes ProtectKernelTunables=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 ReadWritePaths=/var/cache/webmap +ReadWritePaths=%t/lock/webmap/download [Install] WantedBy=webmap-update@%i.target |