diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2024-09-25 19:18:15 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2024-09-25 21:44:41 +0200 |
| commit | f0feb7c74ca2252ef2513da12fc85be9684a54b4 (patch) | |
| tree | 301152d43426ab8f242ab835fdc04e6f3ba21196 /files/etc/systemd/system/webmap-import@.service | |
| parent | 5f9605745f4f8e59d5aba78da18b8a50bc4a5d88 (diff) | |
Copy webmap-publish.
We also replace persistent/shared RuntimeDirectory settings with
directories defined as tmpfiles.d(5) entries. This gives more control
over access control.
We also change static compression from gzip to brotli on the HTTPd.
Diffstat (limited to 'files/etc/systemd/system/webmap-import@.service')
| -rw-r--r-- | files/etc/systemd/system/webmap-import@.service | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/webmap-import@.service index 540e7de..06d204c 100644 --- a/files/etc/systemd/system/webmap-import@.service +++ b/files/etc/systemd/system/webmap-import@.service @@ -20,12 +20,9 @@ IOSchedulingClass=idle Type=oneshot ExecStart=/usr/local/bin/webmap-import \ --cachedir=/var/cache/webmap \ - --lockfile=%t/webmap/lock \ + --lockfile=%t/lock/webmap/lock \ -- %I -RuntimeDirectory=webmap -RuntimeDirectoryPreserve=yes - # Hardening NoNewPrivileges=yes ProtectHome=yes @@ -35,6 +32,7 @@ ProtectControlGroups=yes ProtectKernelModules=yes ProtectKernelTunables=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +ReadWritePaths=%t/lock/webmap PrivateTmp=yes [Install] |