Kai
35af26c794
The curator app (Python backend, tests, systemd units, config, scripts) now lives in this repo under scenarios/curator/backend, exported from the standalone checkout's tracked tree (.pi mirror, venv and caches excluded). 149 unit tests pass from the new location; _SHARED_LIB and eval GOLDEN_DIR resolve unchanged. History not preserved per decision. verify-no-secrets: the ASSIGN heuristic now requires the value to carry entropy (a digit or uppercase letter), so vendored Python kwargs like token=extraction_token no longer false-positive while real base64/hex/random secrets still trip it.
31 lines
818 B
Desktop File
31 lines
818 B
Desktop File
[Unit]
|
|
Description=Curator cover image refresh
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
WorkingDirectory=/home/claw/pi-workspaces/curator
|
|
Environment=PYTHONPATH=/home/claw/pi-workspaces/curator
|
|
EnvironmentFile=/home/claw/.config/curator/curator.env
|
|
ExecStart=/usr/bin/python3 -m curator refresh-covers
|
|
# Network-bound and safe to fail. A stall here used to delay the backup, which
|
|
# shared the same oneshot unit and ran first.
|
|
TimeoutStartSec=30m
|
|
|
|
ProtectSystem=strict
|
|
ProtectHome=read-only
|
|
ReadWritePaths=/home/claw/.local/share/curator
|
|
PrivateTmp=true
|
|
UMask=0077
|
|
NoNewPrivileges=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
RestrictRealtime=true
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
MemoryMax=1G
|
|
TasksMax=64
|