# The hourly off-site backup of learn.halkyon.eu, on its server: deploy/backup.sh, as
# deploy, started by halkyon-backup.timer. Installed with the timer as
# /etc/systemd/system/halkyon-backup.service; deploy/backups.md has the steps.
#
# deploy is in the docker group, which is as good as root, so sandboxing this unit
# would protect little: it keeps to the basics.
[Unit]
Description=Off-site backup of learn.halkyon.eu's database
Documentation=file:///home/deploy/halkyon-learn/deploy/backups.md
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=oneshot
User=deploy
Group=deploy
ExecStart=/home/deploy/halkyon-learn/deploy/backup.sh
PrivateTmp=yes
NoNewPrivileges=yes
ProtectSystem=full
# Behind the instance for CPU and disk.
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=7