* consider running the /etc/systemd/system/conservancy-www-db.service on a timer so it doesn't require an Apache restart (and brief outage)

# SystemD services

## Installing

Install all SystemD services with:

    systemctl enable conservancy-www-db.service

##  Website updates

Monitor the website update service with:

## Fundraiser/sustainer database updates

The `conservancy-www-db.service` applies SQL updates to the website

database. These include the fundraising total and sustainers to be publicly

acknowledged.

# Remove old Django login sessions.

# Update the fundraiser total/sustainer list from an SQL file on Apache restart.

[Unit]

Description=Update Conservancy website database

Before=apache2.service

[Service]

Type=oneshot

User=www-data

ExecStart=/usr/bin/sqlite3 -bail /var/lib/www/database/conservancy-website.sqlite3 ".timeout 30000" "BEGIN TRANSACTION;" ".read /home/debian/django-supporters-list.sql" "COMMIT;"

SystemCallFilter=~@clock @cpu-emulation @debug @module @mount @obsolete

CapabilityBoundingSet=

NoNewPrivileges=true

PrivateDevices=true

PrivateNetwork=true

PrivateTmp=true

PrivateUsers=false

ProtectControlGroups=true

ProtectHome=read-only

ProtectKernelModules=true

ProtectKernelTunables=true

ProtectSystem=strict

ReadWritePaths=/var/lib/www/database

[Install]

WantedBy=apache2.service

# Run the website update script (see also: conservancy-www-update.timer).

# Pull in and apply Conservancy website updates from the git repository.

#

# This is intended to be run on a timer. Note that it does *not* restart the

# Django application or run the migrate and collectstatic commands.