X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/d9746d11a294fd7c305f0d88dace5e4e60b32dc9..8f86a03526fe64640e48ef21b2f8aad8066ed5a7:/cookbooks/planet/recipes/dump.rb?ds=inline diff --git a/cookbooks/planet/recipes/dump.rb b/cookbooks/planet/recipes/dump.rb index 409d100b1..f7a143181 100644 --- a/cookbooks/planet/recipes/dump.rb +++ b/cookbooks/planet/recipes/dump.rb @@ -17,15 +17,7 @@ # limitations under the License. # -node.default[:incron][:planetdump] = { - :user => "root", - :path => "/store/backup", - :events => %w[IN_CREATE IN_MOVED_TO], - :command => "/bin/systemctl start planetdump@$#" -} - include_recipe "git" -include_recipe "incron" package %w[ gcc @@ -48,6 +40,9 @@ package %w[ php-cli php-curl mktorrent + xmlstarlet + libxml2-utils + inotify-tools ] directory "/opt/planet-dump-ng" do @@ -59,7 +54,7 @@ end git "/opt/planet-dump-ng" do action :sync repository "https://github.com/zerebubuth/planet-dump-ng.git" - revision "v1.2.0" + revision "v1.2.7" depth 1 user "root" group "root" @@ -99,7 +94,7 @@ directory "/store/planetdump" do recursive true end -%w[planetdump planet-mirror-redirect-update].each do |program| +%w[planetdump planetdump-trigger planet-mirror-redirect-update].each do |program| template "/usr/local/bin/#{program}" do source "#{program}.erb" owner "root" @@ -113,17 +108,44 @@ systemd_service "planetdump@" do user "www-data" exec_start "/usr/local/bin/planetdump %i" memory_max "64G" - private_tmp true - private_devices true - private_network true - protect_system "full" - protect_home true - no_new_privileges true + sandbox true + read_write_paths [ + "/store/planetdump", + "/store/planet/pbf", + "/store/planet/planet", + "/var/log/exim4", + "/var/spool/exim4" + ] +end + +systemd_service "planetdump-trigger" do + description "Planet dump trigger" + user "root" + exec_start "/usr/local/bin/planetdump-trigger" + sandbox true + restrict_address_families "AF_UNIX" +end + +service "planetdump-trigger" do + action [:enable, :start] + subscribes :restart, "template[/usr/local/bin/planetdump-trigger]" end -cron_d "planet-dump-mirror" do - minute "*/10" +systemd_service "planet-dump-mirror" do + description "Update planet dump mirrors" + exec_start "/usr/local/bin/planet-mirror-redirect-update" user "www-data" - command "/usr/local/bin/planet-mirror-redirect-update" - mailto "horntail-www-data-cron@firefishy.com" + sandbox :enable_network => true + memory_deny_write_execute false + read_write_paths "/store/planet/.htaccess" +end + +systemd_timer "planet-dump-mirror" do + description "Update planet dump mirrors" + on_boot_sec "10min" + on_unit_inactive_sec "10min" +end + +service "planet-dump-mirror.timer" do + action [:enable, :start] end