orchestrator-agent
1a781bfdb8
CI / ci (push) Successful in 4m51s
Co-authored-by: orchestrator-agent <20+orchestrator-agent@code.cubecraftcreations.com>
29 lines
1.1 KiB
Desktop File
29 lines
1.1 KiB
Desktop File
# Runs the nightly MealQuest media backup (/usr/local/sbin/mealquest-media-backup).
|
|
# Triggered by mealquest-media-backup.timer; output goes to the journal.
|
|
# Installing it and running it by hand: CTXD project mealquest,
|
|
# RUNBOOKS.MD "Media — nightly rsync".
|
|
#
|
|
# The script runs as the app's user (10001, host user "mealquest") with no
|
|
# capabilities. systemd, as root, only bind-mounts the data volume's root
|
|
# (a root-owned path the app cannot replace) read-only at
|
|
# /run/mealquest-data and copies the NAS key into the credentials directory.
|
|
[Unit]
|
|
Description=Back up MealQuest media to the Synology NAS
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/mealquest-media-backup
|
|
User=mealquest
|
|
Group=mealquest
|
|
LoadCredential=nas_key:/home/overseer/mealquest/deploy/secrets/litestream_key
|
|
BindReadOnlyPaths=/var/lib/docker/volumes/mealquest-data/_data:/run/mealquest-data
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|