Skip to content
Snippets Groups Projects
Commit a8145a2e authored by Jörg Sachse's avatar Jörg Sachse
Browse files

feat: implement DisApp maintenance window timers to accommodate ZIH...

feat: implement DisApp maintenance window timers to accommodate ZIH maintenance windows and prevent read access
parent 2fb00686
No related branches found
No related tags found
No related merge requests found
Pipeline #5142 failed
......@@ -206,6 +206,40 @@
owner: "{{ vault_subapp_user }}"
group: "{{ vault_subapp_group }}"
# ZIH has monthly maintenance windows for their VMware environment, which also
# affects the Library Manager VMs used by SLUBArchiv.digital. To make sure
# there is no read access during that time, we shutdown the DisApp and start it
# afterwards using systemd timers.
- name: create directory for SystemD units
ansible.builtin.file:
path: "/usr/local/lib/systemd/system/"
mode: "0755"
state: directory
owner: "root"
group: "root"
- name: install DisApp maintenance services and timers
ansible.builtin.template:
src: "usr/local/lib/systemd/system/{{ item }}.j2"
dest: "/usr/local/lib/systemd/system/{{ item }}"
mode: "0644"
owner: "root"
group: "root"
loop:
- "disapp_maintenance_begin.service"
- "disapp_maintenance_begin.timer"
- "disapp_maintenance_end.timer"
- name: enable DisApp maintenance services and timers
ansible.builtin.systemd:
name: "{{ item.name }}"
enabled: "{{ item.enabled | default(true) }}"
state: "{{ item.state | default('started') }}"
daemon_reload: true
loop:
- name: "disapp_maintenance_begin.service"
state: "stopped"
- name: "disapp_maintenance_begin.timer"
- name: "disapp_maintenance_end.timer"
################################################
- name: disable check_ie_sample Service
......
[Unit]
Description=stop DisApp for monthly maintenance at ZIH
After=remote-fs.target
[Service]
Type=simple
Restart=no
Environment="PERL5LIB=/usr/local/perl/"
ExecStart=/usr/bin/perl -I /usr/local/perl/ /usr/local/bin/disapp_rosetta.pl \
--config-file /home/access/.disapp/disapp.cfg \
--stop
User={{ vault_disapp_user }}
Group={{ vault_disapp_group }}
### Security features
# documented at https://www.freedesktop.org/software/systemd/man/systemd.exec.html
# or at `man (5) systemd.exec`
ProtectSystem=strict
ProtectHome=read-only
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
#RestrictSUIDSGID=true
## RemoveIPC=true
## PrivateMounts=true
## MountFlags=
## SystemCallFilter is a Whitelist!!!
#SystemCallFilter=@debug,@file-system
#SystemCallErrorNumber=1337
[Install]
WantedBy=multi-user.target
[Unit]
Description=timer for disapp_maintenance.service
[Timer]
# run on the 1st Tuesday of each month
# You can validate your calendar expressions using `systemd-analyze calendar EXPR`.
OnCalendar=Tue *-*-01..07 08:00:00
Unit=disapp_maintenance_begin
[Install]
WantedBy=default.target
[Unit]
Description=timer for disapp_maintenance.service
[Timer]
# run on the 1st Tuesday of each month
# You can validate your calendar expressions using `systemd-analyze calendar EXPR`.
OnCalendar=Tue *-*-01..07 11:00:00
Unit=disapp.service
[Install]
WantedBy=default.target
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment