# Jarl: one database backup (with the DNSSEC keys), run daily by
# jarl-backup.timer.
# Installed as /etc/systemd/system/jarl-backup.service (see
# docs/operations.md#backups). What to keep, and where, is in the backup:
# section of /etc/jarl/jarl.yaml; when it runs is in jarl-backup.timer.
[Unit]
Description=Jarl database backup
Documentation=file:///usr/local/share/doc/jarl/docs/operations.md
# Nothing to back up before 'jarld init'. (If you moved the database in
# jarl.yaml, change this with 'systemctl edit jarl-backup.service'.)
ConditionPathExists=/var/lib/jarl/jarl.db

[Service]
Type=oneshot
ExecStart=/usr/local/bin/jarld --config /etc/jarl/jarl.yaml backup
User=jarl
Group=jarl
UMask=0077
Nice=10
IOSchedulingClass=idle

# The database (read, and the backup's record written) and the backup
# directory. If you change backup.dir in jarl.yaml, allow the new one too:
# 'systemctl edit jarl-backup.service' and add ReadWritePaths=/new/dir.
ProtectSystem=strict
ReadWritePaths=/var/lib/jarl -/var/backups/jarl
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
NoNewPrivileges=yes
# Read access to every file, and nothing else: named's DNSSEC private keys
# (under /var/lib/bind/jarl/dnssec-keys) are readable only by named's user,
# and the backup includes them. Everything outside the paths above stays
# read-only (ProtectSystem=strict).
CapabilityBoundingSet=CAP_DAC_READ_SEARCH
AmbientCapabilities=CAP_DAC_READ_SEARCH
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM