blob: 981ef7bc67712a5dbfb84aa10510ea879e2aaeea (
plain) (
tree)
|
|
[Unit]
Description=fetch new Newsboat articles
OnFailure=notify-email@%n
ConditionPathExists=!%h/.local/share/newsboat/cache.db.lock
[Service]
Type=oneshot
LogsDirectory=newsboat
LogsDirectoryMode=0700
ExecStart=newsboat --execute=reload --log-file=%L/newsboat/%p.log --log-level=5
# Hardening
IPAddressDeny=any
IPAddressAllow=localhost
KeyringMode=private
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
RestrictAddressFamilies=AF_UNIX
RestrictAddressFamilies=~AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
UMask=0077
# Slowing
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=7
|
