From 5f50605d68fcd83501bd3914c5682ace32235540 Mon Sep 17 00:00:00 2001
From: Ryan Kavanagh <rak@rak.ac>
Date: Wed, 5 Nov 2025 09:32:33 -0500
Subject: sbuild update timer

---
 dot_config/systemd/user/sbuild-update.service      | 29 ++++++++++++++++++++++
 dot_config/systemd/user/sbuild-update.timer        | 11 ++++++++
 .../symlink_sbuild-update.timer                    |  1 +
 3 files changed, 41 insertions(+)
 create mode 100644 dot_config/systemd/user/sbuild-update.service
 create mode 100644 dot_config/systemd/user/sbuild-update.timer
 create mode 100644 dot_config/systemd/user/timers.target.wants/symlink_sbuild-update.timer

diff --git a/dot_config/systemd/user/sbuild-update.service b/dot_config/systemd/user/sbuild-update.service
new file mode 100644
index 0000000..82c6bb3
--- /dev/null
+++ b/dot_config/systemd/user/sbuild-update.service
@@ -0,0 +1,29 @@
+[Unit]
+Description=Update sbuild unshare chroot tarballs
+ConditionACPower=true
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=%h/.local/lib/sbuild/update-chroots.sh
+LimitNOFILE=131072
+IOSchedulingClass=idle
+Nice=19
+
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_CHOWN
+IPAddressDeny=any
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+PrivateNetwork=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHostname=true
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service @chown
diff --git a/dot_config/systemd/user/sbuild-update.timer b/dot_config/systemd/user/sbuild-update.timer
new file mode 100644
index 0000000..2576e16
--- /dev/null
+++ b/dot_config/systemd/user/sbuild-update.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Update sbuild unshare chroot tarballs
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=1h
+AccuracySec=6h
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/dot_config/systemd/user/timers.target.wants/symlink_sbuild-update.timer b/dot_config/systemd/user/timers.target.wants/symlink_sbuild-update.timer
new file mode 100644
index 0000000..24c026e
--- /dev/null
+++ b/dot_config/systemd/user/timers.target.wants/symlink_sbuild-update.timer
@@ -0,0 +1 @@
+/home/rak/.config/systemd/user/sbuild-update.timer
\ No newline at end of file
-- 
cgit v1.2.3