summaryrefslogtreecommitdiffstats
path: root/roles/common
diff options
context:
space:
mode:
Diffstat (limited to 'roles/common')
-rw-r--r--roles/common/files/etc/systemd/system/bacula-fd.service.d/override.conf (renamed from roles/common/files/etc/systemd/system/bacula-fd.service)12
-rw-r--r--roles/common/tasks/bacula.yml22
2 files changed, 10 insertions, 24 deletions
diff --git a/roles/common/files/etc/systemd/system/bacula-fd.service b/roles/common/files/etc/systemd/system/bacula-fd.service.d/override.conf
index 119b3a2..537bf1e 100644
--- a/roles/common/files/etc/systemd/system/bacula-fd.service
+++ b/roles/common/files/etc/systemd/system/bacula-fd.service.d/override.conf
@@ -1,18 +1,9 @@
-[Unit]
-Description=Bacula File Daemon service
-After=network.target
-
[Service]
-Type=simple
-StandardOutput=syslog
-ExecStart=/usr/sbin/bacula-fd -f -c /etc/bacula/bacula-fd.conf
-
# Hardening
NoNewPrivileges=yes
ProtectHome=read-only
ProtectSystem=strict
ReadWriteDirectories=/var/lib/bacula
-RuntimeDirectory=bacula
PrivateTmp=yes
PrivateDevices=yes
ProtectControlGroups=yes
@@ -20,6 +11,3 @@ ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
CapabilityBoundingSet=CAP_DAC_READ_SEARCH
-
-[Install]
-WantedBy=multi-user.target
diff --git a/roles/common/tasks/bacula.yml b/roles/common/tasks/bacula.yml
index fb37b5b..308e358 100644
--- a/roles/common/tasks/bacula.yml
+++ b/roles/common/tasks/bacula.yml
@@ -10,7 +10,7 @@
- name: Delete /etc/bacula/common_default_passwords
file: path=/etc/bacula/common_default_passwords state=absent
-# Create with:
+# Populate with:
# echo $director-dir $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-fd
- name: Ensure /etc/bacula/passwords-fd exists
file: path=/etc/bacula/passwords-fd
@@ -54,23 +54,21 @@
tags:
- genkey
-- name: Copy bacula-fd.service
- copy: src=etc/systemd/system/bacula-fd.service
- dest=/etc/systemd/system/bacula-fd.service
+- name: Create /etc/systemd/system/bacula-fd.service.d
+ file: path=/etc/systemd/system/bacula-fd.service.d
+ state=directory
+ owner=root group=root
+ mode=0755
+
+- name: Copy bacula-fd.service override
+ copy: src=etc/systemd/system/bacula-fd.service.d/override.conf
+ dest=/etc/systemd/system/bacula-fd.service.d/override.conf
owner=root group=root
mode=0644
notify:
- systemctl daemon-reload
- Restart bacula-fd
-# We use RuntimeDirectory in our service unit to avoid permission issues
-# caused by the restrictive Capability Bounding Set
-- name: Mask /usr/lib/tmpfiles.d/bacula.conf
- file: src=/dev/null
- dest=/etc/tmpfiles.d/bacula.conf
- owner=root group=root
- state=link
-
- meta: flush_handlers
- name: Enable bacula-fd