32 lines
1.1 KiB
Desktop File
32 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Verified application backup to rclone crypt storage
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# Bash is an allowed entry point for this SELinux service domain. Running rsync
|
|
# directly as the entry point can fail even when child execution is permitted.
|
|
ExecStart=/bin/bash /usr/local/sbin/app-backup.sh
|
|
# A privileged backup crosses web/mail/user labels and preserves those labels.
|
|
# Keep enforcing globally; scope unconfined execution to this backup service.
|
|
# This deliberately removes SELinux confinement for this unit and its children.
|
|
# No '-' prefix: an unavailable/denied context must fail visibly.
|
|
SELinuxContext=system_u:system_r:unconfined_service_t:s0
|
|
# Timeout sends TERM: Bash runs its recovery trap; grace time permits service restart.
|
|
TimeoutStartSec=12h
|
|
TimeoutStopSec=5min
|
|
KillMode=mixed
|
|
UMask=0077
|
|
Nice=10
|
|
IOSchedulingClass=best-effort
|
|
IOSchedulingPriority=6
|
|
PrivateTmp=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
Environment=LANG=C
|
|
Environment=LC_ALL=C
|
|
StandardOutput=journal
|
|
StandardError=journal
|