Added a systemd unit and logrotate configuration, packaged in the release

deploy/job-search.logrotate

@@ -0,0 +1,18 @@
+# logrotate configuration for job-search's logs (see README.md, "Rotating
+# the logs"). Install as /etc/logrotate.d/job-search; it is in the release
+# tarball next to the binary.
+#
+# job-search opens its log file once and has no signal to reopen it, so the
+# file is copied and then truncated in place (copytruncate). A line written
+# between the copy and the truncation is lost.
+/var/log/job-search/*.log {
+    weekly
+    rotate 8
+    compress
+    delaycompress
+    missingok
+    notifempty
+    copytruncate
+    # /var/log/job-search belongs to the service user, so rotate as it.
+    su job-search job-search
+}

deploy/job-search.service

@@ -0,0 +1,80 @@
+# job-search: serves the API and frontend, and runs the enabled sources'
+# fetchers (job-search serve). See README.md, "Running as a service".
+#
+# Install, from the release tarball's directory (job-search-<version>-<arch>):
+#   sudo useradd --system --home-dir /var/lib/job-search --shell /usr/sbin/nologin job-search
+#   sudo install -m 755 job-search /usr/local/bin/job-search
+#   sudo install -d -m 750 -o root -g job-search /etc/job-search
+#   sudo install -m 640 -o root -g job-search config.yaml /etc/job-search/config.yaml
+#   sudo install -d -m 750 -o job-search -g job-search /var/lib/job-search /var/log/job-search
+#   sudo -u job-search /usr/local/bin/job-search --config /etc/job-search/config.yaml migrate up --create
+#   sudo install -m 644 job-search.service /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now job-search
+#
+# /etc/job-search/config.yaml should set at least:
+#   database:
+#       file: /var/lib/job-search/jobsearch.db
+#   logging:
+#       file: /var/log/job-search/job-search.log
+# Without logging.file, logs go to the journal (as coloured text). Rotate the
+# log file with job-search.logrotate:
+#   sudo install -m 644 job-search.logrotate /etc/logrotate.d/job-search
+#
+# After each upgrade, migrate the database before restarting:
+#   sudo -u job-search /usr/local/bin/job-search --config /etc/job-search/config.yaml migrate up
+#   sudo systemctl restart job-search
+
+[Unit]
+Description=Job Search: procurement opportunities server and fetcher
+Documentation=https://git.avsdev.uk/Go/job-search
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=job-search
+Group=job-search
+# /var/lib/job-search and /var/log/job-search, created and owned by the
+# service user; the only places it can write.
+StateDirectory=job-search
+StateDirectoryMode=0750
+LogsDirectory=job-search
+LogsDirectoryMode=0750
+WorkingDirectory=/var/lib/job-search
+ExecStart=/usr/local/bin/job-search --config /etc/job-search/config.yaml serve
+# serve shuts down cleanly on SIGTERM: the HTTP server drains and in-flight
+# fetches get up to 10s.
+KillSignal=SIGTERM
+TimeoutStopSec=30
+# A failing source stops serve on purpose; restart to retry it.
+Restart=on-failure
+RestartSec=30
+UMask=0027
+
+# Hardening
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+
+[Install]
+WantedBy=multi-user.target