From 1af347391f9f54b370dfc7395464b8ed637a79ca Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Fri, 6 Mar 2026 13:50:24 +0100
Subject: Rename "webmap" to the less generic "geodata".

The database has uses beyond the webmap.
Cf. ca91a579770c89d25aefae220079bf336fa88dc9 in tools.
---
 files/etc/systemd/system/geodata-import@.service | 41 ++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 files/etc/systemd/system/geodata-import@.service

(limited to 'files/etc/systemd/system/geodata-import@.service')

diff --git a/files/etc/systemd/system/geodata-import@.service b/files/etc/systemd/system/geodata-import@.service
new file mode 100644
index 0000000..7d652ea
--- /dev/null
+++ b/files/etc/systemd/system/geodata-import@.service
@@ -0,0 +1,41 @@
+[Unit]
+Description=Geodata updater service (import ‘%I’ to PostGIS)
+After=postgresql.service geodata-update@%i.target
+After=geodata-download@%i.service
+Upholds=geodata-update@%i.target
+
+[Service]
+User=_geodata
+Group=_geodata
+
+Nice=15
+IOSchedulingClass=idle
+
+# Point TMPDIR to something that is not a tmpfs as we need to unpack large archives
+Environment=TMPDIR=/var/tmp
+
+Type=oneshot
+ExecStart=/usr/local/bin/geodata-import \
+    --cachedir=%C/geodata \
+    --lockfile=%t/lock/geodata/lock \
+    --lockdir-sources=%t/lock/geodata/cache \
+    --mvtdir=/var/www/webmap/tiles/%I \
+    --mvt-compress \
+    --metadata-compress \
+    -- %I
+
+# Hardening
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=%t/lock/geodata
+ReadWritePaths=/var/www/webmap/tiles
+PrivateTmp=yes
+
+[Install]
+WantedBy=geodata-update@%i.target
-- 
cgit v1.2.3