diff options
| author | Leitwolf | 2026-11-13 05:06:08 +0300 |
|---|---|---|
| committer | GitHub | 2026-11-13 05:06:08 +0300 |
| commit | d82258f9f3bb23a0f59d79b984ff527942efc0f0 (patch) | |
| tree | da8b19d9dbe959d85ab60b044295b3c1afb8cc3a /ops/git/systemd/git-mirror.service | |
| parent | 189b15ca0909033a40626bc8f600686e561b9cbb (diff) | |
| parent | f980fee24c5302173fa00ab758b7c54213d2bb7a (diff) | |
| download | progmaweb-content/catalog-without-tala.tar.gz | |
Merge branch 'main' into content/catalog-without-talacontent/catalog-without-tala
Diffstat (limited to 'ops/git/systemd/git-mirror.service')
| -rw-r--r-- | ops/git/systemd/git-mirror.service | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/ops/git/systemd/git-mirror.service b/ops/git/systemd/git-mirror.service new file mode 100644 index 0000000..1e07bd0 --- /dev/null +++ b/ops/git/systemd/git-mirror.service @@ -0,0 +1,44 @@ +# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> +# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1 + +[Unit] +Description=Mirror the public repositories of Progmasoft from GitHub for git.progmasoft.com +Wants=network-online.target +After=network-online.target + +[Service] +Type=oneshot +User=gitmirror +Group=gitmirror +ExecStart=/usr/local/libexec/git-mirror +Nice=10 +IOSchedulingClass=idle +TimeoutStartSec=15min + +# It reads public repositories over HTTPS and writes only the mirrors. +NoNewPrivileges=yes +ProtectSystem=strict +ReadWritePaths=/srv/git/mirrors +ProtectHome=yes +PrivateTmp=yes +PrivateDevices=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectKernelLogs=yes +ProtectControlGroups=yes +ProtectClock=yes +ProtectHostname=yes +ProtectProc=invisible +ProcSubset=pid +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +LockPersonality=yes +MemoryDenyWriteExecute=yes +SystemCallArchitectures=native +SystemCallFilter=@system-service +SystemCallFilter=~@privileged @resources +CapabilityBoundingSet= +AmbientCapabilities= +UMask=0022 |