forked from borgmatic-collective/borgmatic
6df6176f3a
This commit changes the comment in sample systemd service. Using a combination of 'ProtectHome' and 'BindPaths' it's possible to hide the irrelevant paths inside /root from borgmatic service when it is run. ReadWritePaths are suggested to be used only for paths that contain borg repositories and the backup sources can be specified as ReadOnlyPaths.
64 lines
2.4 KiB
Desktop File
64 lines
2.4 KiB
Desktop File
[Unit]
|
|
Description=borgmatic backup
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
# Prevent borgmatic from running unless the machine is plugged into power. Remove this line if you
|
|
# want to allow borgmatic to run anytime.
|
|
ConditionACPower=true
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
|
|
# Security settings for systemd running as root, optional but recommended to improve security. You
|
|
# can disable individual settings if they cause problems for your use case. For more details, see
|
|
# the systemd manual: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
|
|
LockPersonality=true
|
|
# Certain borgmatic features like Healthchecks integration need MemoryDenyWriteExecute to be off.
|
|
# But you can try setting it to "yes" for improved security if you don't use those features.
|
|
MemoryDenyWriteExecute=no
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
# Restrict write access
|
|
# Change to 'ProtectSystem=strict' and uncomment 'ProtectHome' to make the whole file
|
|
# system read-only be default and uncomment 'ReadWritePaths' for the required write access.
|
|
# Add local repositroy paths to the list of 'ReadWritePaths' like '-/mnt/my_backup_drive'.
|
|
ProtectSystem=full
|
|
# ReadWritePaths=-/mnt/my_backup_drive
|
|
# ReadOnlyPaths=-/var/lib/my_backup_source
|
|
# This will mount a tmpfs on top of /root and pass through needed paths
|
|
# ProtectHome=tmpfs
|
|
# BindPaths=-/root/.cache/borg -/root/.cache/borg -/root/.borgmatic
|
|
|
|
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_RAW
|
|
|
|
# Lower CPU and I/O priority.
|
|
Nice=19
|
|
CPUSchedulingPolicy=batch
|
|
IOSchedulingClass=best-effort
|
|
IOSchedulingPriority=7
|
|
IOWeight=100
|
|
|
|
Restart=no
|
|
# Prevent rate limiting of borgmatic log events. If you are using an older version of systemd that
|
|
# doesn't support this (pre-240 or so), you may have to remove this option.
|
|
LogRateLimitIntervalSec=0
|
|
|
|
# Delay start to prevent backups running during boot. Note that systemd-inhibit requires dbus and
|
|
# dbus-user-session to be installed.
|
|
ExecStartPre=sleep 1m
|
|
ExecStart=systemd-inhibit --who="borgmatic" --why="Prevent interrupting scheduled backup" /root/.local/bin/borgmatic --verbosity -1 --syslog-verbosity 1
|