mirror of
https://github.com/foo-dogsquared/ansible-playbooks.git
synced 2025-01-31 22:57:58 +00:00
37 lines
956 B
SYSTEMD
37 lines
956 B
SYSTEMD
|
[Unit]
|
||
|
|
Description=Backup to external archive
|
||
|
|
Documentation=https://www.borgbackup.org/ https://torsion.org/borgmatic/ man:borg(1)
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
LockPersonality=true
|
||
|
|
MemoryDenyWriteExecute=no
|
||
|
|
NoNewPrivileges=yes
|
||
|
|
PrivateDevices=yes
|
||
|
|
PrivateTmp=yes
|
||
|
|
ProtectClock=yes
|
||
|
|
ProtectControlGroups=yes
|
||
|
|
ProtectHostname=yes
|
||
|
|
ProtectKernelLogs=yes
|
||
|
|
ProtectKernelModules=yes
|
||
|
|
ProtectKernelTunables=yes
|
||
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
||
|
|
RestrictNamespaces=yes
|
||
|
|
RestrictRealtime=yes
|
||
|
|
RestrictSUIDSGID=yes
|
||
|
|
SystemCallArchitectures=native
|
||
|
|
SystemCallFilter=@system-service
|
||
|
|
SystemCallErrorNumber=EPERM
|
||
|
|
|
||
|
|
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_RAW
|
||
|
|
|
||
|
|
Nice=19
|
||
|
|
CPUSchedulingPolicy=batch
|
||
|
|
IOSchedulingClass=best-effort
|
||
|
|
IOSchedulingPriority=7
|
||
|
|
IOWeight=100
|
||
|
|
Restart=no
|
||
|
|
LogRateLimitIntervalSec=0
|
||
|
|
|
||
|
|
ExecStartPre=sleep 1m
|
||
|
|
ExecStart=systemd-inhibit --who="borgmatic" --why="Prevent interrupting scheduled backup" /usr/bin/borgmatic --verbosity -1 --syslog-verbosity 1
|