30 lines
1.2 KiB
Desktop File
30 lines
1.2 KiB
Desktop File
 
|
# Packet Station nightly database backup on a native VM (scripts/backup/ps-backup.sh, installed as
|
||
|
|
# /usr/local/sbin/ps-backup by deploy/vm/install.sh). Started by packetstation-backup.timer.
|
||
|
|
# Runs as root: it reads the backup config, writes /var/backups/packetstation and switches to the
|
||
|
|
# postgres OS user (setpriv) for pg_dump on the local socket.
|
||
|
|
[Unit]
|
||
|
|
Description=Packet Station database backup (pg_dump)
|
||
|
|
Documentation=file:///opt/packetstation/current/docs/DEPLOY.md
|
||
|
|
Wants=[email protected]
|
||
|
|
After=[email protected]
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
Type=oneshot
|
||
|
|
ExecStart=/usr/local/sbin/ps-backup --config /etc/packetstation/backup.conf
|
||
|
|
Environment=KEEP=7
|
||
|
|
# Gentle on the VM: the dump runs while the shop is closed, but the app stays up.
|
||
|
|
Nice=10
|
||
|
|
IOSchedulingClass=idle
|
||
|
|
TimeoutStartSec=1h
|
||
|
|
# Sandbox. Read-only file system except the backup folder. setpriv needs CAP_SETUID and CAP_SETGID.
|
||
|
|
NoNewPrivileges=yes
|
||
|
|
PrivateTmp=yes
|
||
|
|
ProtectSystem=strict
|
||
|
|
ProtectHome=yes
|
||
|
|
ReadWritePaths=/var/backups/packetstation
|
||
|
|
ProtectKernelTunables=yes
|
||
|
|
ProtectKernelModules=yes
|
||
|
|
ProtectControlGroups=yes
|
||
|
|
RestrictSUIDSGID=yes
|
||
|
|
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_DAC_OVERRIDE
|