# Packet Station: SQL migrations, once per boot and once per upgrade, before the app and the worker.
# Installed by deploy/vm/install.sh into /etc/systemd/system. See docs/DEPLOY.md, "Native VM install".
# ps-upgrade restarts this unit after switching /opt/packetstation/current to a new release.
[Unit]
Description=Packet Station database migrations
Documentation=file:///opt/packetstation/current/docs/DEPLOY.md
Wants=postgresql@16-main.service network-online.target
After=postgresql@16-main.service network-online.target
Before=packetstation-app.service packetstation-worker.service
ConditionPathExists=/opt/packetstation/current/deploy/vm/ps-launch.sh

[Service]
Type=oneshot
RemainAfterExit=yes
User=packetstation
Group=packetstation
EnvironmentFile=/etc/packetstation/packetstation.env
# migrate needs both passwords: it logs in as ps_migrate and grants to ps_app.
LoadCredential=postgres_migrate_password:/etc/packetstation/secrets/postgres_migrate_password
LoadCredential=postgres_app_password:/etc/packetstation/secrets/postgres_app_password
ExecStart=/opt/packetstation/current/deploy/vm/ps-launch.sh migrate
SyslogIdentifier=packetstation-migrate
TimeoutStartSec=15min
WorkingDirectory=/
UMask=0027

# Sandbox. The whole file system is read-only; migrate writes nothing outside PostgreSQL.
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
InaccessiblePaths=/etc/packetstation/secrets
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
RemoveIPC=yes
CapabilityBoundingSet=
AmbientCapabilities=
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
# No [Install]: the app and the worker pull this unit in (Requires=).