[Unit]
Description=sl-map-web SQLite online backup
After=sl-map-web.service
Requires=sl-map-web.service

[Service]
Type=oneshot
User=sl-map-web
Group=sl-map-web
EnvironmentFile=/etc/sl-map-web/sl-map-web.env
ExecStartPre=/bin/sh -c 'rm -f "${BACKUP_DIR:?BACKUP_DIR not set}/sl-map-web.db.new"'
ExecStart=/bin/sh -c 'umask 027 && /usr/bin/sqlite3 /var/lib/sl-map-web/sl-map-web.db ".backup ${BACKUP_DIR:?BACKUP_DIR not set}/sl-map-web.db.new"'
ExecStart=/bin/sh -c 'mv -f "${BACKUP_DIR:?BACKUP_DIR not set}/sl-map-web.db.new" "${BACKUP_DIR}/sl-map-web.db"'

NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
CapabilityBoundingSet=
AmbientCapabilities=
UMask=0027
ReadWritePaths=/var/lib/sl-map-web
