Dustin C. Hatch
679ea47bf7
When the Home Assistant container restarts, Podman relabels the entire `/var/lib/homeassistant` directory as `container_file_t`. Since the *homeassistant* user's home directory is `/var/lib/homeassistant`, its `~/.ssh` directory is thus also relabeled, preventing the SSH daemon from accessing it. Since Home Assistant itself does not need access to this path, we can tell systemd to mount an empty tmpfs filesystem there in the service unit's mount namespace. This way, when Podman relabels the directory, it will change the label of the tmpfs mount point instead of the actual directory.
30 lines
781 B
Django/Jinja
30 lines
781 B
Django/Jinja
# vim: set ft=systemd :
|
|
[Unit]
|
|
Description=Home Assistant
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=all
|
|
ExecStartPre=-/usr/bin/podman container rm --ignore -f homeassistant
|
|
ExecStart=/usr/bin/podman run \
|
|
--pull never \
|
|
--sdnotify=conmon --cgroups=no-conmon \
|
|
--rm \
|
|
--network=host \
|
|
--name homeassistant \
|
|
-v /var/lib/homeassistant:/config:Z \
|
|
--uidmap 0:{{ homeassistant_user.uid }}:1 \
|
|
--gidmap 0:{{ homeassistant_user.group }}:1 \
|
|
--uidmap 1:4000000:65536 \
|
|
--gidmap 1:4000000:65536 \
|
|
ghcr.io/home-assistant/{{ homeassistant_image_name }}:stable
|
|
ProtectSystem=full
|
|
TemporaryFileSystem=/var/lib/homeassistant/.ssh
|
|
UMask=0077
|
|
TimeoutStartSec=5min
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|