# Packet Station nightly database backup (scripts/backup/ps-backup.sh).
# Installed by root on docker-1: see scripts/backup/README.md. Started by packetstation-backup.timer.
# Runs as root because it talks to the Docker daemon and writes /var/backups/packetstation.
[Unit]
Description=Packet Station database backup (pg_dump of each stack)
Documentation=file:///home/spencerm/packetstation/repo/scripts/backup/README.md
Wants=docker.service
After=docker.service

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/ps-backup.sh --config /etc/packetstation/backup.conf
Environment=KEEP=7
# Gentle on the host: the dump runs while the shop is closed, but the stacks stay up.
Nice=10
IOSchedulingClass=idle
TimeoutStartSec=1h
# Hardening. /usr, /boot and /etc are read-only to the script; it writes only the backup folders.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes