44 lines
1.3 KiB
Desktop File
44 lines
1.3 KiB
Desktop File
 
|
[Unit]
|
||
|
|
Description=Vèy Lalwa — passage de collecte législative
|
||
|
|
Documentation=https://labola.o-k-i.net/cyber-mawonaj/veye-lalwa/src/branch/main/README-pipeline.md
|
||
|
|
After=network-online.target
|
||
|
|
Wants=network-online.target
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
Type=oneshot
|
||
|
|
User=__APP__
|
||
|
|
Group=__APP__
|
||
|
|
WorkingDirectory=__INSTALL_DIR__
|
||
|
|
Environment=PYTHONUNBUFFERED=1
|
||
|
|
EnvironmentFile=__INSTALL_DIR__/.env
|
||
|
|
ExecStart=__INSTALL_DIR__/venv/bin/python -m pipeline.update
|
||
|
|
|
||
|
|
# Un passage qui s'éternise a rencontré un problème réseau, pas une charge de
|
||
|
|
# travail : on l'arrête plutôt que de le laisser tenir la base ouverte.
|
||
|
|
TimeoutStartSec=1800
|
||
|
|
|
||
|
|
StandardOutput=append:/var/log/__APP__/pipeline.log
|
||
|
|
StandardError=inherit
|
||
|
|
|
||
|
|
# Durcissement : le pipeline lit le réseau et n'écrit que dans son répertoire
|
||
|
|
# de données.
|
||
|
|
NoNewPrivileges=yes
|
||
|
|
PrivateTmp=yes
|
||
|
|
PrivateDevices=yes
|
||
|
|
ProtectSystem=strict
|
||
|
|
ProtectHome=yes
|
||
|
|
ReadWritePaths=__DATA_DIR__ /var/log/__APP__
|
||
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||
|
|
RestrictNamespaces=yes
|
||
|
|
RestrictRealtime=yes
|
||
|
|
DevicePolicy=closed
|
||
|
|
ProtectClock=yes
|
||
|
|
ProtectHostname=yes
|
||
|
|
ProtectProc=invisible
|
||
|
|
ProtectControlGroups=yes
|
||
|
|
ProtectKernelModules=yes
|
||
|
|
ProtectKernelTunables=yes
|
||
|
|
LockPersonality=yes
|
||
|
|
SystemCallArchitectures=native
|
||
|
|
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
|