| 1 |
# One-shot: tells sandod to pull the latest prod backup. |
| 2 |
# Paired with sandod-backup-fetch.timer for daily execution. |
| 3 |
# |
| 4 |
# Place at /etc/systemd/system/sandod-backup-fetch.service on the Sando host. |
| 5 |
|
| 6 |
[Unit] |
| 7 |
Description=Sando: fetch latest prod backup |
| 8 |
After=sandod.service network-online.target |
| 9 |
Wants=network-online.target |
| 10 |
Requires=sandod.service |
| 11 |
|
| 12 |
[Service] |
| 13 |
Type=oneshot |
| 14 |
# Reuse the same env file the daemon does — gives us $SANDO_DAEMON and the |
| 15 |
# bearer token. /backup/fetch is an authenticated mutator (CF2); the header is |
| 16 |
# harmless when SANDO_API_TOKEN is empty (the daemon ignores it on a tokenless |
| 17 |
# loopback bind). |
| 18 |
EnvironmentFile=/etc/sando/sando.env |
| 19 |
ExecStart=/usr/bin/curl -fsS --max-time 600 -H "Authorization: Bearer ${SANDO_API_TOKEN}" -X POST ${SANDO_DAEMON}/backup/fetch |
| 20 |
# Service exits non-zero if the daemon refuses; fine — we want the timer to |
| 21 |
# log + retry on the next cycle. Don't restart aggressively. |
| 22 |
|