3 files changed, 41 insertions, 0 deletions
diff --git a/dot_config/systemd/user/sbuild-update.service b/dot_config/systemd/user/sbuild-update.service
new file mode 100644
index 0000000..82c6bb3
--- /dev/null
+++ b/dot_config/systemd/user/sbuild-update.service
@@ -0,0 +1,29 @@
+[Unit]
+Description=Update sbuild unshare chroot tarballs
+ConditionACPower=true
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=%h/.local/lib/sbuild/update-chroots.sh
+LimitNOFILE=131072
+IOSchedulingClass=idle
+Nice=19
+
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_CHOWN
+IPAddressDeny=any
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+PrivateNetwork=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHostname=true
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service @chown
diff --git a/dot_config/systemd/user/sbuild-update.timer b/dot_config/systemd/user/sbuild-update.timer
new file mode 100644
index 0000000..2576e16
--- /dev/null
+++ b/dot_config/systemd/user/sbuild-update.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Update sbuild unshare chroot tarballs
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=1h
+AccuracySec=6h
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/dot_config/systemd/user/timers.target.wants/symlink_sbuild-update.timer b/dot_config/systemd/user/timers.target.wants/symlink_sbuild-update.timer
new file mode 100644
index 0000000..24c026e
--- /dev/null
+++ b/dot_config/systemd/user/timers.target.wants/symlink_sbuild-update.timer
@@ -0,0 +1 @@
+/home/rak/.config/systemd/user/sbuild-update.timer
+\ No newline at end of file