spencerm/PacketStation
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

Native VM install kit: systemd units, launcher, install and upgrade scripts; backups, restore and doctor without docker exec; DEPLOY.md VM, NPM and NFS sections

Browse Source 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
spencerm
2026-10-30 18:08:48 -06:00
co-authored by Claude Opus 5.5
parent f025479358
commit 45a1d1a42a
22 changed files with 2357 additions and 413 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/backup/packetstation-backup.service
+15 -11
View File
@@ -1,25 +1,29 @@
# Packet Station nightly database backup (scripts/backup/ps-backup.sh).
# Installed by root on docker-1: see scripts/backup/README.md. Started by packetstation-backup.timer.
# Runs as root because it talks to the Docker daemon and writes /var/backups/packetstation.
# Packet Station nightly database backup on a native VM (scripts/backup/ps-backup.sh, installed as
# /usr/local/sbin/ps-backup by deploy/vm/install.sh). Started by packetstation-backup.timer.
# Runs as root: it reads the backup config, writes /var/backups/packetstation and switches to the
# postgres OS user (setpriv) for pg_dump on the local socket.
[Unit]
Description=Packet Station database backup (pg_dump of each stack)
Documentation=file:///home/spencerm/packetstation/repo/scripts/backup/README.md
Wants=docker.service
After=docker.service
Description=Packet Station database backup (pg_dump)
Documentation=file:///opt/packetstation/current/docs/DEPLOY.md
Wants=[email protected]
After=[email protected]
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/ps-backup.sh --config /etc/packetstation/backup.conf
ExecStart=/usr/local/sbin/ps-backup --config /etc/packetstation/backup.conf
Environment=KEEP=7
# Gentle on the host: the dump runs while the shop is closed, but the stacks stay up.
# Gentle on the VM: the dump runs while the shop is closed, but the app stays up.
Nice=10
IOSchedulingClass=idle
TimeoutStartSec=1h
# Hardening. /usr, /boot and /etc are read-only to the script; it writes only the backup folders.
# Sandbox. Read-only file system except the backup folder. setpriv needs CAP_SETUID and CAP_SETGID.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/backups/packetstation
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_CHOWN CAP_FOWNER CAP_DAC_OVERRIDE