test (b5fc5c9a) · Commits · jan.koester / blogi

debian/blogi-container-setup.service

+1 −1

Original line number	Diff line number	Diff line
		[Unit]
		Description=Setup blogi nspawn container rootfs
		ConditionPathExists=!/var/lib/machines/blogi/usr/bin/blogi
		ConditionPathExists=!/var/lib/machines/blogi/etc/hostname
		Before=blogi.service

		[Service]

+2 −8

Original line number	Diff line number	Diff line
		@@ -2,8 +2,7 @@
		Boot=no
		Parameters=/usr/bin/blogi -c yaml:/etc/blogi/config.yaml -f true
		WorkingDirectory=/var/lib/blogi
		PrivateUsers=pick
		NotifyReady=yes
		NotifyReady=no

		[Files]
		# Read-only bind mounts for the binary and plugins
		@@ -11,19 +10,14 @@ BindReadOnly=/usr/bin/blogi
		BindReadOnly=/usr/lib/blogi
		BindReadOnly=/usr/share/blogi

		# Configuration (read-only from container perspective)
		# Configuration
		BindReadOnly=/etc/blogi

		# Writable state directory
		Bind=/var/lib/blogi

		# SSL certificates (read-only, renewed by host)
		BindReadOnly=/etc/blogi/ssl

		# DNS resolution
		BindReadOnly=/etc/resolv.conf

		[Network]
		VirtualEthernet=no
		Port=tcp:8080:8080
		Port=tcp:8443:8443

+2 −6

Original line number	Diff line number	Diff line
		@@ -2,14 +2,14 @@
		Description=Blogi Blog Engine Server (nspawn container)
		After=network.target authdb.service
		Requires=blogi-container-setup.service
		After=blogi-container-setup.service

		[Service]
		Type=notify
		Type=simple
		ExecStart=/usr/bin/systemd-nspawn \
		--machine=blogi \
		--directory=/var/lib/machines/blogi \
		--settings=override \
		--notify-ready=yes \
		--keep-unit \
		--quiet
		Restart=on-failure
		@@ -17,9 +17,5 @@ RestartSec=5
		KillMode=mixed
		TimeoutStopSec=30

		# Hardening
		ProtectHome=yes
		PrivateTmp=yes

		[Install]
		WantedBy=multi-user.target