summaryrefslogtreecommitdiffstats
path: root/files/etc/systemd/system/webmap-publish@.service
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2024-09-25 19:18:15 +0200
committerGuilhem Moulin <guilhem@fripost.org>2024-09-25 21:44:41 +0200
commitf0feb7c74ca2252ef2513da12fc85be9684a54b4 (patch)
tree301152d43426ab8f242ab835fdc04e6f3ba21196 /files/etc/systemd/system/webmap-publish@.service
parent5f9605745f4f8e59d5aba78da18b8a50bc4a5d88 (diff)
Copy webmap-publish.
We also replace persistent/shared RuntimeDirectory settings with directories defined as tmpfiles.d(5) entries. This gives more control over access control. We also change static compression from gzip to brotli on the HTTPd.
Diffstat (limited to 'files/etc/systemd/system/webmap-publish@.service')
-rw-r--r--files/etc/systemd/system/webmap-publish@.service40
1 files changed, 40 insertions, 0 deletions
diff --git a/files/etc/systemd/system/webmap-publish@.service b/files/etc/systemd/system/webmap-publish@.service
new file mode 100644
index 0000000..e2f8e6b
--- /dev/null
+++ b/files/etc/systemd/system/webmap-publish@.service
@@ -0,0 +1,40 @@
+[Unit]
+Description=Webmap updater service (publish %I as MVT)
+#After=postgresql.service webmap-update@%i.target
+#After=webmap-download@%i.service
+#After=webmap-import@%i.service
+#Upholds=webmap-update@%i.target
+
+[Service]
+User=_webmap-publish
+Group=_webmap
+
+Nice=15
+IOSchedulingClass=idle
+
+Type=oneshot
+ExecStart=/usr/local/bin/webmap-publish \
+ --lockfile=%t/lock/webmap/lock \
+ --destdir=/var/www/webmap/tiles/%i \
+ --name=%I \
+ --webroot=/var/www/webmap \
+ --metadata=/var/www/webmap/tiles/metadata.json \
+ --metadata-lockfile=%t/lock/webmap/tiles.lock \
+ --compress \
+ -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/var/www/webmap/tiles
+ReadWritePaths=%t/lock/webmap
+PrivateTmp=yes
+
+#[Install]
+#WantedBy=webmap-update@%i.target