From 3ccc29ca12c7c60d86ca6cdf99078c4d4be7bc28 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Sat, 1 Jun 2024 16:05:01 +0200 Subject: Add webmap task. --- files/etc/systemd/system/webmap-download@.service | 38 +++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 files/etc/systemd/system/webmap-download@.service (limited to 'files/etc/systemd/system/webmap-download@.service') diff --git a/files/etc/systemd/system/webmap-download@.service b/files/etc/systemd/system/webmap-download@.service new file mode 100644 index 0000000..a928a13 --- /dev/null +++ b/files/etc/systemd/system/webmap-download@.service @@ -0,0 +1,38 @@ +[Unit] +Description=Webmap updater service (download %I) +# Chaining logic from https://serverfault.com/questions/1079993/why-does-my-systemd-timer-only-trigger-once-when-the-unit-is-a-target#answer-1128671 +# XXX Looks like Upholds= prevents running a single unit, as it causes +# webmap-update@%i.target to start upon `systemctl start webmap-download@foo.service` +After=network-online.target webmap-update@%i.target +Upholds=webmap-update@%i.target + +[Service] +User=_webmap-download +Group=nogroup + +Nice=15 +IOSchedulingClass=idle + +Type=oneshot +ExecStart=/usr/local/bin/webmap-download \ + --cachedir=/var/cache/webmap \ + --lockdir=%t/webmap-download \ + --no-exit-code \ + --quiet \ + -- %I + +# Hardening +NoNewPrivileges=yes +ProtectHome=yes +ProtectSystem=strict +PrivateDevices=yes +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +ReadWritePaths=/var/cache/webmap +RuntimeDirectory=webmap-download +RuntimeDirectoryPreserve=yes + +[Install] +WantedBy=webmap-update@%i.target -- cgit v1.2.3