[Unit]
Description=Update %i via distronomicon
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
# Configuration: Customize via `systemctl edit distronomicon@<app>.service`
#
# To configure, run: sudo systemctl edit distronomicon@myapp.service
# Then set the REQUIRED environment variables:
#
# [Service]
# Environment="DISTRONOMICON_REPO=owner/myapp"
# Environment="DISTRONOMICON_PATTERN=myapp-.*\.tar\.gz"
#
# REQUIRED environment variables:
# - DISTRONOMICON_REPO: GitHub repository in owner/repo format
# - DISTRONOMICON_PATTERN: Regex pattern to match release assets
#
# Optional environment variables:
# - GITHUB_TOKEN: GitHub API token (for private repos or higher rate limits)
# - GITHUB_HOST: GitHub Enterprise host (default: https://api.github.com)
# - STATE_DIRECTORY: State directory (default: auto-set by systemd)
# - DISTRONOMICON_CHECKSUM_PATTERN: Checksum file pattern (e.g., SHA256SUMS)
# - DISTRONOMICON_RESTART_COMMAND: Command to run after update
# - DISTRONOMICON_RETAIN: Number of old releases to keep (default: 3)
# - DISTRONOMICON_INSTALL_ROOT: Install base directory (default: /opt)
# - DISTRONOMICON_ALLOW_PRERELEASE: Include prereleases (set to "true")
#
# NOTE: If you change DISTRONOMICON_INSTALL_ROOT, you must also override
# ReadWritePaths to grant access to the custom location:
#
# [Service]
# Environment="DISTRONOMICON_INSTALL_ROOT=/custom/path"
# ReadWritePaths=/custom/path
#
# Example configuration with optional variables:
# [Service]
# Environment="DISTRONOMICON_REPO=owner/myapp"
# Environment="DISTRONOMICON_PATTERN=myapp-.*\.tar\.gz"
# Environment="GITHUB_TOKEN=ghp_..."
# Environment="DISTRONOMICON_CHECKSUM_PATTERN=SHA256SUMS"
# Environment="DISTRONOMICON_RESTART_COMMAND=systemctl restart myapp"
# Environment="DISTRONOMICON_RETAIN=5"
ExecStart=/usr/local/bin/distronomicon --app %i update
# Restart on failure with backoff
Restart=on-failure
RestartSec=5m
# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
StateDirectory=distronomicon
StateDirectoryMode=0750
ReadWritePaths=/opt
ProtectHome=true
[Install]
WantedBy=multi-user.target