From f0feb7c74ca2252ef2513da12fc85be9684a54b4 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Wed, 25 Sep 2024 19:18:15 +0200 Subject: Copy webmap-publish. We also replace persistent/shared RuntimeDirectory settings with directories defined as tmpfiles.d(5) entries. This gives more control over access control. We also change static compression from gzip to brotli on the HTTPd. --- files/etc/systemd/system/webmap-import@.service | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'files/etc/systemd/system/webmap-import@.service') diff --git a/files/etc/systemd/system/webmap-import@.service b/files/etc/systemd/system/webmap-import@.service index 540e7de..06d204c 100644 --- a/files/etc/systemd/system/webmap-import@.service +++ b/files/etc/systemd/system/webmap-import@.service @@ -20,12 +20,9 @@ IOSchedulingClass=idle Type=oneshot ExecStart=/usr/local/bin/webmap-import \ --cachedir=/var/cache/webmap \ - --lockfile=%t/webmap/lock \ + --lockfile=%t/lock/webmap/lock \ -- %I -RuntimeDirectory=webmap -RuntimeDirectoryPreserve=yes - # Hardening NoNewPrivileges=yes ProtectHome=yes @@ -35,6 +32,7 @@ ProtectControlGroups=yes ProtectKernelModules=yes ProtectKernelTunables=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +ReadWritePaths=%t/lock/webmap PrivateTmp=yes [Install] -- cgit v1.2.3