bwilliams
71eca2f194
The terminal logger always coloured its text, so output piped or redirected to a file, and the systemd journal, got escape codes. It now colours only an interactive terminal. The service's logs can therefore go to the journal: logging.file is now optional for it, and the unit's comments and the README say so.
81 lines
2.8 KiB
Desktop File
81 lines
2.8 KiB
Desktop File
# job-search: serves the API and frontend, and runs the enabled sources'
|
|
# fetchers (job-search serve). See README.md, "Running as a service".
|
|
#
|
|
# Install, from the release tarball's directory (job-search-<version>-<arch>):
|
|
# sudo useradd --system --home-dir /var/lib/job-search --shell /usr/sbin/nologin job-search
|
|
# sudo install -m 755 job-search /usr/local/bin/job-search
|
|
# sudo install -d -m 750 -o root -g job-search /etc/job-search
|
|
# sudo install -m 640 -o root -g job-search config.yaml /etc/job-search/config.yaml
|
|
# sudo install -d -m 750 -o job-search -g job-search /var/lib/job-search /var/log/job-search
|
|
# sudo -u job-search /usr/local/bin/job-search --config /etc/job-search/config.yaml migrate up --create
|
|
# sudo install -m 644 job-search.service /etc/systemd/system/
|
|
# sudo systemctl daemon-reload
|
|
# sudo systemctl enable --now job-search
|
|
#
|
|
# /etc/job-search/config.yaml should set the database:
|
|
# database:
|
|
# file: /var/lib/job-search/jobsearch.db
|
|
# Logs go to the journal (journalctl -u job-search), unless logging.file is
|
|
# set to log to a file instead, rotated with job-search.logrotate:
|
|
# logging:
|
|
# file: /var/log/job-search/job-search.log
|
|
# sudo install -m 644 job-search.logrotate /etc/logrotate.d/job-search
|
|
#
|
|
# After each upgrade, migrate the database before restarting:
|
|
# sudo -u job-search /usr/local/bin/job-search --config /etc/job-search/config.yaml migrate up
|
|
# sudo systemctl restart job-search
|
|
|
|
[Unit]
|
|
Description=Job Search: procurement opportunities server and fetcher
|
|
Documentation=https://git.avsdev.uk/Go/job-search
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=job-search
|
|
Group=job-search
|
|
# /var/lib/job-search and /var/log/job-search, created and owned by the
|
|
# service user; the only places it can write.
|
|
StateDirectory=job-search
|
|
StateDirectoryMode=0750
|
|
LogsDirectory=job-search
|
|
LogsDirectoryMode=0750
|
|
WorkingDirectory=/var/lib/job-search
|
|
ExecStart=/usr/local/bin/job-search --config /etc/job-search/config.yaml serve
|
|
# serve shuts down cleanly on SIGTERM: the HTTP server drains and in-flight
|
|
# fetches get up to 10s.
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=30
|
|
# A failing source stops serve on purpose; restart to retry it.
|
|
Restart=on-failure
|
|
RestartSec=30
|
|
UMask=0027
|
|
|
|
# Hardening
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|