diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2024-06-10 06:02:45 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2024-09-25 18:44:19 +0200 |
| commit | 5f9605745f4f8e59d5aba78da18b8a50bc4a5d88 (patch) | |
| tree | d8994616e44319f927d228d2256c0b15d2d47711 /files/etc/systemd/system | |
| parent | f2d133b81d98eb84acabef11b0bd919a98d5d13d (diff) | |
Copy webmap-import.
Diffstat (limited to 'files/etc/systemd/system')
| -rw-r--r-- | files/etc/systemd/system/webmap-import@.service | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/webmap-import@.service new file mode 100644 index 0000000..540e7de --- /dev/null +++ b/files/etc/systemd/system/webmap-import@.service @@ -0,0 +1,41 @@ +[Unit] +Description=Webmap updater service (import %I to PostgreSQL) +After=postgresql.service webmap-update@%i.target +After=webmap-download@%i.service +Upholds=webmap-update@%i.target + +# XXX webmap-download write cached files atomatically but there is no +# guarantee that GDAL/OGR opens them atomically. It'd therefore make +# sense to use the following Conflict= directive, however systemd skips +# webmap-download@%i.service in that case. +#Conflicts=webmap-download@%i.service + +[Service] +User=_webmap-import +Group=_webmap + +Nice=15 +IOSchedulingClass=idle + +Type=oneshot +ExecStart=/usr/local/bin/webmap-import \ + --cachedir=/var/cache/webmap \ + --lockfile=%t/webmap/lock \ + -- %I + +RuntimeDirectory=webmap +RuntimeDirectoryPreserve=yes + +# Hardening +NoNewPrivileges=yes +ProtectHome=yes +ProtectSystem=strict +PrivateDevices=yes +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +PrivateTmp=yes + +[Install] +WantedBy=webmap-update@%i.target |