Kai
88b06d782f
The curator Python backend (package, tests, systemd units, config templates, scripts) now lives under scenarios/curator/backend and is the single source of truth; the live checkout at the workspace path is a runtime copy. Exported from the app repo's tracked tree via git archive (no history, .pi/venv/caches excluded). 149 unit tests pass from the new location. profile.toml backend is now repo-relative (scenarios/curator/backend); verify-generated.sh resolves a relative backend against REPO_ROOT. verify-no-secrets ASSIGN heuristic now requires value entropy so vendored kwargs like token=extraction_token no longer false-positive. README documents the backend/ layout and the operator-owned app rollout step.
31 lines
770 B
Desktop File
31 lines
770 B
Desktop File
[Unit]
|
|
Description=Curator database backup and retention
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
WorkingDirectory=/home/claw/pi-workspaces/curator
|
|
Environment=PYTHONPATH=/home/claw/pi-workspaces/curator
|
|
EnvironmentFile=/home/claw/.config/curator/curator.env
|
|
ExecStart=/usr/bin/python3 -m curator backup
|
|
TimeoutStartSec=15m
|
|
|
|
# Local disk only; no network is needed, so egress stays closed.
|
|
IPAddressDeny=any
|
|
|
|
ProtectSystem=strict
|
|
ProtectHome=read-only
|
|
ReadWritePaths=/home/claw/.local/share/curator
|
|
ReadWritePaths=/mnt/truenas/multimedia/curator
|
|
PrivateTmp=true
|
|
UMask=0077
|
|
NoNewPrivileges=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
RestrictRealtime=true
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
MemoryMax=1G
|
|
TasksMax=64
|