abrown38andClaude Opus 5.5
3c0808591f
Subnets served per interface, pools, reservations, options at three levels, leases in SQLite saved before the ACK, ping and decline conflict checks, validated changes with history and undo, users and tokens, an audit log, a Kea importer, a sandboxed systemd unit and Debian packages. Tested with real udhcpc and dhcpcd clients in Docker (scripts/e2e.sh). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
45 lines
1.3 KiB
Desktop File
45 lines
1.3 KiB
Desktop File
# Steward: one database backup, run daily by steward-backup.timer.
|
|
# Installed as /etc/systemd/system/steward-backup.service (see
|
|
# docs/operations.md#backups). What to keep, and where, is in the backup:
|
|
# section of /etc/steward/steward.yaml.
|
|
[Unit]
|
|
Description=Steward database backup
|
|
Documentation=file:///usr/local/share/doc/steward/docs/operations.md
|
|
# Nothing to back up before 'stewardd init'.
|
|
ConditionPathExists=/var/lib/steward/steward.db
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/stewardd --config /etc/steward/steward.yaml backup
|
|
User=steward
|
|
Group=steward
|
|
UMask=0077
|
|
Nice=10
|
|
IOSchedulingClass=idle
|
|
|
|
# If you change backup.dir in steward.yaml, allow the new one too:
|
|
# 'systemctl edit steward-backup.service' and add ReadWritePaths=/new/dir.
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/steward -/var/backups/steward
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
PrivateNetwork=yes
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|