abrown38andClaude Opus 5.5
293e6ddd33
- Daily database backups: jarl-backup.timer runs 'jarld backup', which writes jarl-<UTC time>.db into backup.dir, checks it before naming it, and prunes by the time in the name while always keeping the newest keep_at_least. New backup: section in jarl.yaml; the dashboard and 'jarl status' show the newest backup and warn when it is stale or failed. The Debian package enables the timer. - 'jarld restore [FILE | latest]': checks the backup, shows it next to the current database, keeps the current one aside and records the restore. 'jarld serve' holds a database lock, so a restore can't run under a live jarld and two jarlds can't share a database. - Token expiry warnings from 14 days ahead: dashboard, token lists, a daily log line, and a CLI warning via the Jarl-Token-Expires header; 'jarl token list --expiring'. - 'jarl zone serials' and the zone page's Name servers tab: compare the serial on a primary zone's secondaries (NS records, also-notify) or a secondary zone's primaries with this server's. - 'jarl zone delegation': for zones on the internet, check the parent's delegation and glue against the zone; an undelegated zone gets a note. - Server: Jarl/<version> header; CLI exit code 2 for failed checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
1.5 KiB
Desktop File
48 lines
1.5 KiB
Desktop File
# Jarl: one database backup, run daily by jarl-backup.timer.
|
|
# Installed as /etc/systemd/system/jarl-backup.service (see
|
|
# docs/operations.md#backups). What to keep, and where, is in the backup:
|
|
# section of /etc/jarl/jarl.yaml; when it runs is in jarl-backup.timer.
|
|
[Unit]
|
|
Description=Jarl database backup
|
|
Documentation=file:///usr/local/share/doc/jarl/docs/operations.md
|
|
# Nothing to back up before 'jarld init'. (If you moved the database in
|
|
# jarl.yaml, change this with 'systemctl edit jarl-backup.service'.)
|
|
ConditionPathExists=/var/lib/jarl/jarl.db
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/jarld --config /etc/jarl/jarl.yaml backup
|
|
User=jarl
|
|
Group=jarl
|
|
UMask=0077
|
|
Nice=10
|
|
IOSchedulingClass=idle
|
|
|
|
# The database (read, and the backup's record written) and the backup
|
|
# directory. If you change backup.dir in jarl.yaml, allow the new one too:
|
|
# 'systemctl edit jarl-backup.service' and add ReadWritePaths=/new/dir.
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/jarl -/var/backups/jarl
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
PrivateNetwork=yes
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|