Re: [RFC PATCH 1/5] maintenance: package systemd units

From: Patrick Steinhardt <ps@pks.im>
Date: Mar 21, 2024, 13:22 UTC
Message-ID: <Zfw0rf7ez7Im1rIx@tanuki>
In-Reply-To: <Zfww9jI2em6ZY4SL@framework>

On Thu, Mar 21, 2024 at 02:07:02PM +0100, Max Gautier wrote:

Show 44 quoted lines

> On Thu, Mar 21, 2024 at 01:37:30PM +0100, Patrick Steinhardt wrote:
> > On Mon, Mar 18, 2024 at 04:31:15PM +0100, Max Gautier wrote:
> > 
> > It would be great to document _why_ we want to package the systemd units
> > alongside with Git.
> > 
> 
> Hum, I wrote that in the cover, but you're right, it should be in the
> commit itself.
> Ack.
> 
> > > ...
> > > diff --git a/systemd/user/git-maintenance@.service b/systemd/user/git-maintenance@.service
> > > new file mode 100644
> > > index 0000000000..87ac0c86e6
> > > --- /dev/null
> > > +++ b/systemd/user/git-maintenance@.service
> > > @@ -0,0 +1,16 @@
> > > +[Unit]
> > > +Description=Optimize Git repositories data
> > > +
> > > +[Service]
> > > +Type=oneshot
> > > +ExecStart=git for-each-repo --config=maintenance.repo \
> > > +          maintenance run --schedule=%i
> > > +LockPersonality=yes
> > > +MemoryDenyWriteExecute=yes
> > > +NoNewPrivileges=yes
> > > +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_VSOCK
> > > +RestrictNamespaces=yes
> > > +RestrictRealtime=yes
> > > +RestrictSUIDSGID=yes
> > > +SystemCallArchitectures=native
> > > +SystemCallFilter=@system-service
> > 
> > Curious, but how did you arrive at these particular restrictions for the
> > unit? Might be something to explain in the commit message, as well.
> > 
> > Patrick
> 
> I copied the unit file which is defined in strings in builtin/gc.c,
> which I delete in patch 3.
> Should the moving be inside one commit, in order to explicit the fact
> that it's only moving things around ?

I don't really think it's necessary. But pointing that out in the commit message would go a long way to explain where exactly these definitions come from.

Patrick