Added a systemd unit and logrotate configuration, packaged in the release

README.md

@@ -39,6 +39,37 @@ The `sqlite_fts5` tag is needed for the database's title search (see
 [Testing](#testing)).
 
 
+## Running as a service
+`deploy/job-search.service` is a systemd unit running `job-search serve`
+(the server and every enabled source's fetcher) as a `job-search` system
+user, from `/usr/local/bin/job-search` with `/etc/job-search/config.yaml`.
+Its comments give the install steps. It keeps its data in
+`/var/lib/job-search` and its log in `/var/log/job-search`, the only places
+it can write, so set `database.file` and `logging.file` there.
+
+- The database isn't migrated on start: run `job-search migrate up`
+  (`--create` the first time) as the `job-search` user before the first
+  start and after each upgrade.
+- A failing source stops `serve` on purpose; the unit restarts it after
+  30s.
+
+### Rotating the logs
+`job-search` opens its log file once and has no signal to reopen it, so
+logrotate must copy the file and truncate it in place (`copytruncate`); a
+line written between the two is lost. `deploy/job-search.logrotate` does
+this weekly for every `*.log` in `/var/log/job-search` (the log and, if
+`server.access_log` is set there, the access log), keeping 8 weeks,
+compressed. `/var/log/job-search` belongs to the service user, so it rotates
+as that user (`su job-search job-search`); logrotate refuses otherwise.
+
+```bash
+# from the release tarball's directory (deploy/job-search.logrotate in the repo)
+sudo install -m 644 job-search.logrotate /etc/logrotate.d/job-search
+sudo logrotate --debug /etc/logrotate.d/job-search   # dry run: what it would do
+sudo logrotate --force /etc/logrotate.d/job-search   # rotate now, to check
+```
+
+
 ## Configuration
 Configuration is read from, in increasing priority:
 1. Built-in defaults
@@ -212,6 +243,7 @@ second one fails with "address already in use".
 | `internal/version` | Version information set at build time |
 | `internal/frontend` | Serves the frontend's build output; embeds `dist/`, copied there from `web/dist` by `npm run sync` |
 | `web` | The frontend (see [web](web/README.md)) |
+| `deploy` | The systemd unit and logrotate configuration (see [Running as a service](#running-as-a-service)) |
 
 
 ## Testing