summaryrefslogtreecommitdiffstats
path: root/files/etc/systemd/system
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2024-06-10 06:02:45 +0200
committerGuilhem Moulin <guilhem@fripost.org>2024-09-25 18:44:19 +0200
commit5f9605745f4f8e59d5aba78da18b8a50bc4a5d88 (patch)
treed8994616e44319f927d228d2256c0b15d2d47711 /files/etc/systemd/system
parentf2d133b81d98eb84acabef11b0bd919a98d5d13d (diff)
Copy webmap-import.
Diffstat (limited to 'files/etc/systemd/system')
-rw-r--r--files/etc/systemd/system/webmap-import@.service41
1 files changed, 41 insertions, 0 deletions
diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/webmap-import@.service
new file mode 100644
index 0000000..540e7de
--- /dev/null
+++ b/files/etc/systemd/system/webmap-import@.service
@@ -0,0 +1,41 @@
+[Unit]
+Description=Webmap updater service (import %I to PostgreSQL)
+After=postgresql.service webmap-update@%i.target
+After=webmap-download@%i.service
+Upholds=webmap-update@%i.target
+
+# XXX webmap-download write cached files atomatically but there is no
+# guarantee that GDAL/OGR opens them atomically. It'd therefore make
+# sense to use the following Conflict= directive, however systemd skips
+# webmap-download@%i.service in that case.
+#Conflicts=webmap-download@%i.service
+
+[Service]
+User=_webmap-import
+Group=_webmap
+
+Nice=15
+IOSchedulingClass=idle
+
+Type=oneshot
+ExecStart=/usr/local/bin/webmap-import \
+ --cachedir=/var/cache/webmap \
+ --lockfile=%t/webmap/lock \
+ -- %I
+
+RuntimeDirectory=webmap
+RuntimeDirectoryPreserve=yes
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+PrivateTmp=yes
+
+[Install]
+WantedBy=webmap-update@%i.target