dev_agentandClaude Opus 5.5
fd05d51ebf
The repository still carried operating steps from the deleted runbook: secret creation and permission commands in deploy/.env.example, build, restart and restore steps in deploy/compose.yaml, a direct "docker compose up -d" in mealquest-firewall.service, a manual run in mealquest-media-backup.service and a dev start command in compose.dev.yaml. Replace each with a pointer to the named section of CTXD project mealquest, RUNBOOKS.MD, keeping every variable, path, owner, mode, port and mount description. Maestro task e81ed994-a510-48e6-9cf6-e76d5d81f56c. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.1 KiB
Desktop File
29 lines
1.1 KiB
Desktop File
# Runs the nightly MealQuest media backup (/usr/local/sbin/mealquest-media-backup).
|
|
# Triggered by mealquest-media-backup.timer; output goes to the journal.
|
|
# Installing it and running it by hand: CTXD project mealquest,
|
|
# RUNBOOKS.MD "Media — nightly rsync".
|
|
#
|
|
# The script runs as the app's user (10001, host user "mealquest") with no
|
|
# capabilities. systemd, as root, only bind-mounts the data volume's root
|
|
# (a root-owned path the app cannot replace) read-only at
|
|
# /run/mealquest-data and copies the NAS key into the credentials directory.
|
|
[Unit]
|
|
Description=Back up MealQuest media to the Synology NAS
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/mealquest-media-backup
|
|
User=mealquest
|
|
Group=mealquest
|
|
LoadCredential=nas_key:/home/overseer/mealquest/deploy/secrets/litestream_key
|
|
BindReadOnlyPaths=/var/lib/docker/volumes/mealquest-data/_data:/run/mealquest-data
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|