# Steward: one database backup, run daily by steward-backup.timer.
# Installed as /etc/systemd/system/steward-backup.service (see
# docs/operations.md#backups). What to keep, and where, is in the backup:
# section of /etc/steward/steward.yaml.
[Unit]
Description=Steward database backup
Documentation=file:///usr/local/share/doc/steward/docs/operations.md
# Nothing to back up before 'stewardd init'.
ConditionPathExists=/var/lib/steward/steward.db

[Service]
Type=oneshot
ExecStart=/usr/local/bin/stewardd --config /etc/steward/steward.yaml backup
User=steward
Group=steward
UMask=0077
Nice=10
IOSchedulingClass=idle

# If you change backup.dir in steward.yaml, allow the new one too:
# 'systemctl edit steward-backup.service' and add ReadWritePaths=/new/dir.
ProtectSystem=strict
ReadWritePaths=/var/lib/steward -/var/backups/steward
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
NoNewPrivileges=yes
CapabilityBoundingSet=
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM