48 lines
1.4 KiB
Desktop File
48 lines
1.4 KiB
Desktop File
 
|
# Passage de veille : collecte les sources officielles et met la base à jour.
|
||
|
|
#
|
||
|
|
# Unité oneshot déclenchée par veille-legislative.timer. Installation :
|
||
|
|
# sudo cp systemd/veille-*.{service,timer,socket} /etc/systemd/system/
|
||
|
|
# sudo systemctl daemon-reload
|
||
|
|
# sudo systemctl enable --now veille-legislative.timer
|
||
|
|
|
||
|
|
[Unit]
|
||
|
|
Description=Veille législative — passage de collecte
|
||
|
|
Documentation=file:///opt/veille-legislative/README-pipeline.md
|
||
|
|
After=network-online.target
|
||
|
|
Wants=network-online.target
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
Type=oneshot
|
||
|
|
User=veille
|
||
|
|
Group=veille
|
||
|
|
WorkingDirectory=/opt/veille-legislative
|
||
|
|
Environment=PYTHONUNBUFFERED=1
|
||
|
|
EnvironmentFile=/opt/veille-legislative/.env
|
||
|
|
ExecStart=/opt/veille-legislative/.venv/bin/python -m pipeline.update
|
||
|
|
|
||
|
|
# Un passage qui s'éternise a rencontré un problème réseau : on l'arrête.
|
||
|
|
TimeoutStartSec=900
|
||
|
|
|
||
|
|
# Durcissement : le pipeline lit le réseau et écrit un seul fichier.
|
||
|
|
NoNewPrivileges=true
|
||
|
|
PrivateTmp=true
|
||
|
|
ProtectSystem=strict
|
||
|
|
ProtectHome=true
|
||
|
|
ReadWritePaths=/opt/veille-legislative/data
|
||
|
|
ProtectKernelTunables=true
|
||
|
|
ProtectKernelModules=true
|
||
|
|
ProtectControlGroups=true
|
||
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||
|
|
RestrictNamespaces=true
|
||
|
|
LockPersonality=true
|
||
|
|
MemoryDenyWriteExecute=true
|
||
|
|
SystemCallFilter=@system-service
|
||
|
|
SystemCallErrorNumber=EPERM
|
||
|
|
|
||
|
|
StandardOutput=journal
|
||
|
|
StandardError=journal
|
||
|
|
SyslogIdentifier=veille-legislative
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=multi-user.target
|