3 files changed, 51 insertions, 0 deletions
diff --git a/files/etc/systemd/system/webmap-download@.service b/files/etc/systemd/system/webmap-download@.service
new file mode 100644
index 0000000..a928a13
--- /dev/null
+++ b/files/etc/systemd/system/webmap-download@.service
@@ -0,0 +1,38 @@
+[Unit]
+Description=Webmap updater service (download %I)
+# Chaining logic from https://serverfault.com/questions/1079993/why-does-my-systemd-timer-only-trigger-once-when-the-unit-is-a-target#answer-1128671
+# XXX Looks like Upholds= prevents running a single unit, as it causes
+# webmap-update@%i.target to start upon `systemctl start webmap-download@foo.service`
+After=network-online.target webmap-update@%i.target
+Upholds=webmap-update@%i.target
+
+[Service]
+User=_webmap-download
+Group=nogroup
+
+Nice=15
+IOSchedulingClass=idle
+
+Type=oneshot
+ExecStart=/usr/local/bin/webmap-download \
+    --cachedir=/var/cache/webmap \
+    --lockdir=%t/webmap-download \
+    --no-exit-code \
+    --quiet \
+    -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/var/cache/webmap
+RuntimeDirectory=webmap-download
+RuntimeDirectoryPreserve=yes
+
+[Install]
+WantedBy=webmap-update@%i.target
diff --git a/files/etc/systemd/system/webmap-update@.target b/files/etc/systemd/system/webmap-update@.target
new file mode 100644
index 0000000..3d9fb7f
--- /dev/null
+++ b/files/etc/systemd/system/webmap-update@.target
@@ -0,0 +1,3 @@
+[Unit]
+Description=Webmap updater (target unit %I)
+StopWhenUnneeded=true
diff --git a/files/etc/systemd/system/webmap-update@.timer b/files/etc/systemd/system/webmap-update@.timer
new file mode 100644
index 0000000..8f62502
--- /dev/null
+++ b/files/etc/systemd/system/webmap-update@.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Webmap updater (timer unit)
+
+[Timer]
+OnCalendar=*-*-* 02:00:00
+RandomizedDelaySec=3600
+Unit=webmap-update@%i.target
+
+[Install]
+WantedBy=timers.target