40 lines
1,023 B
SYSTEMD
40 lines
1,023 B
SYSTEMD
|
# deploy/mapserver.service
|
||
|
|
# ~/.config/systemd/user/mapserver.service
|
||
|
|
#
|
||
|
|
# systemctl --user daemon-reload
|
||
|
|
# systemctl --user enable --now mapserver
|
||
|
|
#
|
||
|
|
# Requires: loginctl enable-linger <user>
|
||
|
|
# Without linger, user units do not start at boot and are killed on logout.
|
||
|
|
|
||
|
|
[Unit]
|
||
|
|
Description=Waymark mapping server
|
||
|
|
# Quadlet generates postgres.service from postgres.container.
|
||
|
|
# Both must be USER units for this ordering to work.
|
||
|
|
After=postgres.service
|
||
|
|
Wants=postgres.service
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
Type=simple
|
||
|
|
EnvironmentFile=%h/.config/mapserver/.env
|
||
|
|
WorkingDirectory=%h
|
||
|
|
ExecStart=%h/.local/bin/rs_maps
|
||
|
|
Restart=on-failure
|
||
|
|
RestartSec=5
|
||
|
|
|
||
|
|
# After= does not mean Postgres is accepting connections; the binary retries
|
||
|
|
# its initial pool connection with backoff, so this only catches hard failures.
|
||
|
|
|
||
|
|
NoNewPrivileges=true
|
||
|
|
PrivateTmp=true
|
||
|
|
ProtectSystem=strict
|
||
|
|
ProtectHome=read-only
|
||
|
|
ReadWritePaths=%h/gpx
|
||
|
|
ProtectKernelTunables=true
|
||
|
|
ProtectControlGroups=true
|
||
|
|
RestrictSUIDSGID=true
|
||
|
|
MemoryDenyWriteExecute=true
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=default.target
|