# Housecarl: one database backup, run daily by housecarl-backup.timer.
# Installed as /etc/systemd/system/housecarl-backup.service (see
# docs/operations.md#backups). What to keep, and where, is in the backup:
# section of /etc/housecarl/housecarl.yaml.
[Unit]
Description=Housecarl database backup
Documentation=file:///usr/local/share/doc/housecarl/docs/operations.md
# Nothing to back up before 'housecarld init'.
ConditionPathExists=/var/lib/housecarl/housecarl.db

[Service]
Type=oneshot
ExecStart=/usr/local/bin/housecarld --config /etc/housecarl/housecarl.yaml backup
User=housecarl
Group=housecarl
UMask=0077
Nice=10
IOSchedulingClass=idle

# If you change backup.dir in housecarl.yaml, allow the new one too:
# 'systemctl edit housecarl-backup.service' and add ReadWritePaths=/new/dir.
ProtectSystem=strict
ReadWritePaths=/var/lib/housecarl -/var/backups/housecarl
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
NoNewPrivileges=yes
CapabilityBoundingSet=
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM