| 1234567891011121314151617181920212223242526272829303132333435363738394041 |
- # systemd unit for the PPS Quarantine Manager.
- #
- # Install (as root):
- # see deploy/README.md for the full walk-through. In short:
- # 1. put the app in /opt/ppsq, create a `ppsq` user that owns it
- # 2. edit the paths/user below if you used different ones
- # 3. cp deploy/ppsq.service /etc/systemd/system/ppsq.service
- # 4. systemctl daemon-reload && systemctl enable --now ppsq
- #
- # IMPORTANT: single process only. Do NOT template this into multiple instances or add
- # web-server workers — the background job queue and SQLite live in-process (see AGENTS.md).
- [Unit]
- Description=PPS Quarantine Manager
- After=network-online.target
- Wants=network-online.target
- [Service]
- Type=simple
- User=ppsq
- Group=ppsq
- WorkingDirectory=/opt/ppsq
- ExecStart=/opt/ppsq/venv/bin/python wsgi.py
- Restart=on-failure
- RestartSec=5
- # Config path is optional: the app defaults to ./config.toml in WorkingDirectory.
- # Uncomment to point elsewhere:
- # Environment=PPSQ_CONFIG=/etc/ppsq/config.toml
- # --- modest hardening (safe defaults; remove any that get in your way) ---
- NoNewPrivileges=true
- PrivateTmp=true
- ProtectSystem=full
- ProtectHome=true
- # The app rewrites config.toml + writes jobs.db/*.log in WorkingDirectory, so it must be
- # writable. If ProtectSystem hides it, grant it explicitly:
- ReadWritePaths=/opt/ppsq
- [Install]
- WantedBy=multi-user.target
|
