# Packet Station: the worker (VISUAL feed, drawings, AD reconcile, integrity, backup check,
# notifications, archive copies). Installed by deploy/vm/install.sh into /etc/systemd/system.
# On production its first start is Spencer's approval of the scheduled VISUAL polling.
[Unit]
Description=Packet Station worker
Documentation=file:///opt/packetstation/current/docs/DEPLOY.md
Requires=packetstation-migrate.service
After=packetstation-migrate.service postgresql@16-main.service network-online.target
Wants=postgresql@16-main.service network-online.target
StartLimitIntervalSec=300
StartLimitBurst=5

[Service]
Type=exec
User=packetstation
Group=packetstation
EnvironmentFile=/etc/packetstation/packetstation.env
LoadCredential=postgres_app_password:/etc/packetstation/secrets/postgres_app_password
LoadCredential=visualkit_password:/etc/packetstation/secrets/visualkit_password
LoadCredential=mfileskit_password:/etc/packetstation/secrets/mfileskit_password
LoadCredential=ldap_bind_password:/etc/packetstation/secrets/ldap_bind_password
LoadCredential=seal_key:/etc/packetstation/secrets/seal_key
ExecStart=/opt/packetstation/current/deploy/vm/ps-launch.sh worker
SyslogIdentifier=packetstation-worker
# /run/packetstation holds the heartbeat file (WORKER_BEAT_FILE, set by ps-launch.sh).
RuntimeDirectory=packetstation
RuntimeDirectoryMode=0755
Restart=on-failure
RestartSec=10s
TimeoutStopSec=60s
WorkingDirectory=/
UMask=0027
MemoryMax=1G

# Sandbox. Read-only file system except the assets and the archive mount. The backup folder
# (BACKUP_DIR) is only read, so it needs no entry here.
ReadWritePaths=/var/lib/packetstation/assets
ReadWritePaths=-/mnt/packetstation-archive
InaccessiblePaths=/etc/packetstation/secrets
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
# AF_NETLINK: glibc's getaddrinfo asks the kernel for the local addresses through it.
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
RemoveIPC=yes
CapabilityBoundingSet=
AmbientCapabilities=
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
# Not set: MemoryDenyWriteExecute (see packetstation-app.service).

[Install]
WantedBy=multi-user.target