2016-07-04 18:19:34 +02:00
|
|
|
[Unit]
|
|
|
|
|
Description=borgmatic backup
|
2019-09-24 19:16:30 +02:00
|
|
|
Wants=network-online.target
|
|
|
|
|
After=network-online.target
|
2021-06-09 19:03:35 +02:00
|
|
|
# Prevent borgmatic from running unless the machine is plugged into power. Remove this line if you
|
|
|
|
|
# want to allow borgmatic to run anytime.
|
2019-09-24 19:43:30 +02:00
|
|
|
ConditionACPower=true
|
2016-07-04 18:19:34 +02:00
|
|
|
|
|
|
|
|
[Service]
|
|
|
|
|
Type=oneshot
|
2019-09-24 19:16:30 +02:00
|
|
|
|
2020-12-09 19:08:07 +01:00
|
|
|
# Security settings for systemd running as root, optional but recommended to improve security. You
|
|
|
|
|
# can disable individual settings if they cause problems for your use case. For more details, see
|
|
|
|
|
# the systemd manual: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
|
2020-08-22 15:41:25 +02:00
|
|
|
LockPersonality=true
|
2020-08-23 23:11:19 +02:00
|
|
|
# Certain borgmatic features like Healthchecks integration need MemoryDenyWriteExecute to be off.
|
|
|
|
|
# But you can try setting it to "yes" for improved security if you don't use those features.
|
2020-08-22 22:37:34 +02:00
|
|
|
MemoryDenyWriteExecute=no
|
2020-08-22 15:41:25 +02:00
|
|
|
NoNewPrivileges=yes
|
|
|
|
|
PrivateDevices=yes
|
|
|
|
|
PrivateTmp=yes
|
|
|
|
|
ProtectClock=yes
|
|
|
|
|
ProtectControlGroups=yes
|
|
|
|
|
ProtectHostname=yes
|
|
|
|
|
ProtectKernelLogs=yes
|
|
|
|
|
ProtectKernelModules=yes
|
|
|
|
|
ProtectKernelTunables=yes
|
|
|
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
|
|
|
RestrictNamespaces=yes
|
|
|
|
|
RestrictRealtime=yes
|
|
|
|
|
RestrictSUIDSGID=yes
|
|
|
|
|
SystemCallArchitectures=native
|
|
|
|
|
SystemCallFilter=@system-service
|
2020-12-01 07:14:28 +01:00
|
|
|
SystemCallErrorNumber=EPERM
|
2023-10-15 11:30:11 +02:00
|
|
|
# To restrict write access further, change "ProtectSystem" to "strict" and
|
|
|
|
|
# uncomment "ReadWritePaths", "TemporaryFileSystem", "BindPaths" and
|
|
|
|
|
# "BindReadOnlyPaths". Then add any local repository paths to the list of
|
|
|
|
|
# "ReadWritePaths". This leaves most of the filesystem read-only to borgmatic.
|
2020-08-22 15:41:25 +02:00
|
|
|
ProtectSystem=full
|
2021-08-30 20:20:34 +02:00
|
|
|
# ReadWritePaths=-/mnt/my_backup_drive
|
|
|
|
|
# This will mount a tmpfs on top of /root and pass through needed paths
|
2023-10-15 11:30:11 +02:00
|
|
|
# TemporaryFileSystem=/root:ro
|
2022-08-28 23:49:23 +02:00
|
|
|
# BindPaths=-/root/.cache/borg -/root/.config/borg -/root/.borgmatic
|
2023-10-15 11:30:11 +02:00
|
|
|
# BindReadOnlyPaths=-/root/.ssh
|
2020-08-22 15:41:25 +02:00
|
|
|
|
2022-01-25 18:26:11 +01:00
|
|
|
# May interfere with running external programs within borgmatic hooks.
|
2020-08-22 15:41:25 +02:00
|
|
|
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_RAW
|
|
|
|
|
|
2019-09-24 19:16:30 +02:00
|
|
|
# Lower CPU and I/O priority.
|
|
|
|
|
Nice=19
|
|
|
|
|
CPUSchedulingPolicy=batch
|
|
|
|
|
IOSchedulingClass=best-effort
|
|
|
|
|
IOSchedulingPriority=7
|
|
|
|
|
IOWeight=100
|
|
|
|
|
|
|
|
|
|
Restart=no
|
2020-01-02 19:05:32 +01:00
|
|
|
# Prevent rate limiting of borgmatic log events. If you are using an older version of systemd that
|
|
|
|
|
# doesn't support this (pre-240 or so), you may have to remove this option.
|
2019-06-12 02:03:40 +02:00
|
|
|
LogRateLimitIntervalSec=0
|
2019-09-24 19:16:30 +02:00
|
|
|
|
2020-05-22 04:56:32 +02:00
|
|
|
# Delay start to prevent backups running during boot. Note that systemd-inhibit requires dbus and
|
|
|
|
|
# dbus-user-session to be installed.
|
2020-01-22 01:03:24 +01:00
|
|
|
ExecStartPre=sleep 1m
|
2023-05-01 00:01:45 +02:00
|
|
|
ExecStart=systemd-inhibit --who="borgmatic" --what="sleep:shutdown" --why="Prevent interrupting scheduled backup" /root/.local/bin/borgmatic --verbosity -2 --syslog-verbosity 1
|
