Download this file
| 1 | # Continuous off-box replication of the fleet's SQLite files under /data to S3 |
| 2 | # via litestream (WAL shipping; the fleet is single-writer-per-DB by design, |
| 3 | # which is exactly litestream's model). /etc/litestream.yml is GENERATED by |
| 4 | # `carlos ops litestream` — never hand-edit it; re-run the verb after adding or |
| 5 | # removing an instance. Hibernating routes are excluded from the config (their |
| 6 | # DBs are replicated by the activator's per-host lease — two replicators on one |
| 7 | # DB was Eleven's lesson). Credentials live in /data/litestream.env (0600). |
| 8 | # Ported from titogo's deploy/systemd/titogo-litestream.service. |
| 9 | [Unit] |
| 10 | Description=carlos litestream (replicate /data SQLite files to S3) |
| 11 | Documentation=https://litestream.io |
| 12 | After=network-online.target data-instances.mount |
| 13 | Wants=network-online.target |
| 14 | |
| 15 | [Service] |
| 16 | ExecStart=/usr/local/bin/litestream replicate -config /etc/litestream.yml |
| 17 | EnvironmentFile=/data/litestream.env |
| 18 | User=carlos |
| 19 | Group=carlos |
| 20 | CapabilityBoundingSet= |
| 21 | NoNewPrivileges=yes |
| 22 | ProtectSystem=strict |
| 23 | # litestream checkpoints the databases it replicates, so it needs /data rw. |
| 24 | ReadWritePaths=/data |
| 25 | ProtectHome=yes |
| 26 | PrivateTmp=yes |
| 27 | PrivateDevices=yes |
| 28 | RestrictAddressFamilies=AF_INET AF_INET6 |
| 29 | MemoryDenyWriteExecute=yes |
| 30 | MemoryMax=256M |
| 31 | CPUWeight=50 |
| 32 | Restart=always |
| 33 | RestartSec=2 |
| 34 | |
| 35 | [Install] |
| 36 | WantedBy=multi-user.target |
| 37 | |
amadan