32 lines
1.1 KiB
Django/Jinja
32 lines
1.1 KiB
Django/Jinja
# Morphit — dynamic DNS update (ddns role). Pushes this box's current public IP
|
|
# to your DNS provider. See ops/ddns/morphit-ddns-update.sh for what it does.
|
|
# MANAGED BY ANSIBLE — kept in sync with the manual ops/ddns/morphit-ddns-setup.sh.
|
|
[Unit]
|
|
Description=Morphit dynamic DNS update
|
|
Documentation=file:///opt/morphit/docs/RUN-A-MORPHIT-NODE.md
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
EnvironmentFile=-{{ morphit_ddns_env_file }}
|
|
ExecStart={{ morphit_ddns_lib }}/morphit-ddns-update.sh
|
|
# The updater exits 1 on a transient failure so the timer simply retries; that
|
|
# must not mark the unit failed forever.
|
|
SuccessExitStatus=0 1
|
|
|
|
# ─── Hardening ───
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
# Only the state-cache dir needs to be writable.
|
|
ReadWritePaths={{ morphit_ddns_state_file | dirname }}
|
|
SyslogIdentifier=morphit-ddns
|
|
|
|
[Install]
|
|
# The timer triggers this; nothing else wants the service directly.
|