mirror of
https://github.com/nikdoof/ansible-borgmatic.git
synced 2025-12-13 02:42:18 +00:00
48 lines
1.5 KiB
Desktop File
48 lines
1.5 KiB
Desktop File
[Unit]
|
|
Description=borgmatic backup
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
# Prevent borgmatic from running unless the machine is plugged into power. Remove this line if you
|
|
# want to allow borgmatic to run anytime.
|
|
ConditionACPower=true
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
ProtectControlGroups=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
ProtectSystem=strict
|
|
ProtectHome=read-only
|
|
ReadWritePaths=-/root/.config/borg -/root/.cache/borg -/root/.borgmatic
|
|
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_RAW
|
|
|
|
# Lower CPU and I/O priority.
|
|
Nice=19
|
|
CPUSchedulingPolicy=batch
|
|
IOSchedulingClass=best-effort
|
|
IOSchedulingPriority=7
|
|
IOWeight=100
|
|
|
|
Restart=no
|
|
# Prevent rate limiting of borgmatic log events. If you are using an older version of systemd that
|
|
# doesn't support this (pre-240 or so), you may have to remove this option.
|
|
LogRateLimitIntervalSec=0
|
|
|
|
# Delay start to prevent backups running during boot. Note that systemd-inhibit requires dbus and
|
|
# dbus-user-session to be installed.
|
|
ExecStartPre=sleep 1m
|
|
ExecStart=systemd-inhibit --who="borgmatic" --why="Prevent interrupting scheduled backup" /usr/local/bin/borgmatic --verbosity -1 --syslog-verbosity 1
|