Improve service initialization, move system files

System files are moved to `/etc/coreos-home-server` to be unambiguous in relation to other, pre-installed system files. Long-running services are also now defined as `Type=notify`, which helps improve ordering and dependencies.
2021-08-14 22:28:28 +01:00 · 2021-08-14 22:28:28 +01:00 · a4580e1cae
parent ef7951dd72
commit a4580e1cae
25 changed files with 143 additions and 102 deletions
--- a/README.md
+++ b/README.md
@ -71,7 +71,7 @@ but also be managed throughout the server's life-cycle.

 The mechanisms for building and deploying services are simple and fairly consistent. Firstly, Podman
 containers and systemd services are built and enabled using the included `container-build` systemd
-service. This will read files from `/etc/container-service` (copied onto the server during
+service. This will read files from `/etc/coreos-home-server` (copied onto the server during
 deployment) and build container images and systemd service definitions as needed.

 ## License
--- a/config/common/container.bu
+++ b/config/common/container.bu
@ -2,12 +2,12 @@ variant: fcos
 version: 1.3.0
 storage:
  trees:
-    - path: /etc/container-service
+    - path: /etc/coreos-home-server
      local: service/
    - path: /etc/systemd/system
      local: common/systemd/
  directories:
-    - path: /etc/container-service
+    - path: /etc/coreos-home-server
      mode: 0700
 systemd:
  units:
--- a/config/common/systemd/container-build@.path
+++ b/config/common/systemd/container-build@.path
@ -2,7 +2,7 @@
 Description=Container build for %I

 [Path]
-PathModified=/etc/container-service/%i/Containerfile
+PathModified=%E/coreos-home-server/%i/Containerfile
 Unit=container-build@%i.service

 [Install]
--- a/config/common/systemd/container-build@.service
+++ b/config/common/systemd/container-build@.service
@ -2,12 +2,12 @@
 Description=Container build for %I
 Wants=network-online.target container-environment@%i.service container-network@internal.service container-build@%i.path
 After=network-online.target container-environment@%i.service container-network@internal.service
-ConditionPathExists=/etc/container-service/%i/Containerfile
+ConditionPathExists=%E/coreos-home-server/%i/Containerfile

 [Service]
 Type=oneshot
 Environment=PODMAN_BUILD_OPTIONS=
-ExecStart=/bin/podman build $PODMAN_BUILD_OPTIONS --file /etc/container-service/%i/Containerfile --tag localhost/%i:latest /etc/container-service/%i
+ExecStart=/bin/podman build $PODMAN_BUILD_OPTIONS --file %E/coreos-home-server/%i/Containerfile --tag localhost/%i:latest %E/coreos-home-server/%i

 [Install]
 WantedBy=multi-user.target
--- a/config/common/systemd/container-environment@.service
+++ b/config/common/systemd/container-environment@.service
@ -1,12 +1,12 @@
 [Unit]
 Description=Container environment for %I
-ConditionPathExists=/etc/container-service/host.env
-ConditionPathExists=/etc/container-service/%i/%i.env.template
+ConditionPathExists=%E/coreos-home-server/host.env
+ConditionPathExists=%E/coreos-home-server/%i/%i.env.template

 [Service]
 Type=oneshot
-EnvironmentFile=/etc/container-service/host.env
-ExecStart=/bin/sh -c 'envsubst < /etc/container-service/%i/%i.env.template > /etc/container-service/%i/%i.env'
+EnvironmentFile=%E/coreos-home-server/host.env
+ExecStart=/bin/sh -c 'envsubst < %E/coreos-home-server/%i/%i.env.template > %E/coreos-home-server/%i/%i.env'

 [Install]
 WantedBy=multi-user.target
--- a/config/service/biboumi/systemd/biboumi.service
+++ b/config/service/biboumi/systemd/biboumi.service
@ -4,13 +4,16 @@ Wants=container-build@%N.service prosody.service
 After=container-build@%N.service prosody.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
-                          --env-file /etc/container-service/%N/%N.env \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --env-file %E/coreos-home-server/%N/%N.env \
                          --volume %N:/var/lib/%N:z \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N

 [Install]
 WantedBy=multi-user.target
--- a/config/service/discord-ircd/systemd/discord-ircd.service
+++ b/config/service/discord-ircd/systemd/discord-ircd.service
@ -4,13 +4,16 @@ Wants=container-build@%N.service
 After=container-build@%N.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
-                          --env-file /etc/container-service/%N/%N.env \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --env-file %E/coreos-home-server/%N/%N.env \
                          --volume %N:/var/lib/rdircd:z \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N

 [Install]
 WantedBy=multi-user.target
--- a/config/service/dovecot/systemd/dovecot.service
+++ b/config/service/dovecot/systemd/dovecot.service
@ -4,17 +4,20 @@ Wants=container-build@%N.service mariadb.service rspamd.service
 After=container-build@%N.service mariadb.service rspamd.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
-                          --env-file /etc/container-service/%N/%N.env \
-                          --env-file /etc/container-service/rspamd/rspamd.env \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --env-file %E/coreos-home-server/%N/%N.env \
+                          --env-file %E/coreos-home-server/rspamd/rspamd.env \
                          --publish 143:143 --publish 993:993 \
                          --volume %N:/var/mail:z \
                          --volume letsencrypt:/etc/ssl/private:z \
-                          --volume /etc/container-service/%N/service/config:/etc/%N/conf.d:z \
+                          --volume %E/coreos-home-server/%N/service/config:/etc/%N/conf.d:z,ro \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N
 ExecReload=/bin/podman exec %N doveadm -v reload

 [Install]
--- a/config/service/git/systemd/git.service
+++ b/config/service/git/systemd/git.service
@ -4,14 +4,18 @@ Wants=container-build@%N.service
 After=container-build@%N.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --net internal --name %N --cap-add AUDIT_WRITE \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --net internal --name %N \
+                          --sdnotify=conmon --cap-add AUDIT_WRITE \
                          --publish 468:22 \
                          --volume %N:/var/lib/git:z \
                          --volume %N-ssh:/etc/ssh/keys:z \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N

 [Install]
 WantedBy=multi-user.target
--- a/config/service/letsencrypt/systemd/letsencrypt-dns-register@.service
+++ b/config/service/letsencrypt/systemd/letsencrypt-dns-register@.service
@ -6,9 +6,9 @@ Before=letsencrypt-dns-renew@%i.timer

 [Service]
 Type=oneshot
-EnvironmentFile=/etc/container-service/letsencrypt/letsencrypt.env
+EnvironmentFile=%E/coreos-home-server/letsencrypt/letsencrypt.env
 ExecStart=/bin/podman run --replace --pull never --rm --name letsencrypt-register-%i \
-                          --env-file /etc/container-service/letsencrypt/letsencrypt.env \
+                          --env-file %E/coreos-home-server/letsencrypt/letsencrypt.env \
                          --volume letsencrypt:/var/lib/letsencrypt:z \
                          localhost/letsencrypt:latest \
                          --accept-tos --pem --path /var/lib/letsencrypt --domains "%i" \
--- a/config/service/letsencrypt/systemd/letsencrypt-dns-renew@.service
+++ b/config/service/letsencrypt/systemd/letsencrypt-dns-renew@.service
@ -5,9 +5,9 @@ After=container-build@letsencrypt.service

 [Service]
 Type=oneshot
-EnvironmentFile=/etc/container-service/letsencrypt/letsencrypt.env
+EnvironmentFile=%E/coreos-home-server/letsencrypt/letsencrypt.env
 ExecStart=/bin/podman run --replace --pull never --rm --name letsencrypt-renew-%i \
-                          --env-file /etc/container-service/letsencrypt/letsencrypt.env \
+                          --env-file %E/coreos-home-server/letsencrypt/letsencrypt.env \
                          --volume letsencrypt:/var/lib/letsencrypt:z \
                          localhost/letsencrypt:latest \
                          --pem --path /var/lib/letsencrypt --domains "%i" \
--- a/config/service/mariadb/systemd/mariadb-migrate@.service
+++ b/config/service/mariadb/systemd/mariadb-migrate@.service
@ -2,21 +2,21 @@
 Description=MariaDB SQL migration for %I
 Wants=container-environment@%i.service mariadb.service
 After=container-environment@%i.service mariadb.service
-ConditionPathExists=/etc/container-service/%i/service/%p.sql
+ConditionPathExists=%E/coreos-home-server/%i/service/%p.sql

 [Service]
 Type=oneshot
-EnvironmentFile=-/etc/container-service/%i/%i.env
-EnvironmentFile=/etc/container-service/mariadb/mariadb.env
+EnvironmentFile=-%E/coreos-home-server/%i/%i.env
+EnvironmentFile=%E/coreos-home-server/mariadb/mariadb.env
 ExecStartPre=/bin/install --mode 0700 --directory /tmp/%N
-ExecStartPre=/bin/sh -c 'envsubst < /etc/container-service/%i/service/%p.sql > /tmp/%N/migrate.sql'
+ExecStartPre=/bin/sh -c 'envsubst < %E/coreos-home-server/%i/service/%p.sql > /tmp/%N/migrate.sql'
 ExecStartPre=/bin/podman create --replace --pull never --rm --name mariadb-migrate-%i --net internal \
                                --volume mariadb:/var/lib/mysql:z \
                                --entrypoint mariadb localhost/mariadb:latest \
-                                --host mariadb --user root --password=${MYSQL_ROOT_PASSWORD} -e 'source /migrate.sql'
+                                --host mariadb --user root --password=${MYSQL_ROOT_PASSWORD} --wait -e 'source /migrate.sql'
 ExecStartPre=/bin/podman cp /tmp/%N/migrate.sql mariadb-migrate-%i:/migrate.sql
 ExecStart=/bin/podman start --attach mariadb-migrate-%i
-ExecStartPost=/bin/podman rm --force mariadb-migrate-%i
+ExecStartPost=/bin/podman rm --ignore --force mariadb-migrate-%i
 ExecStartPost=/bin/rm -Rf /tmp/%N

 [Install]
--- a/config/service/mariadb/systemd/mariadb.service
+++ b/config/service/mariadb/systemd/mariadb.service
@ -4,18 +4,17 @@ Wants=container-build@%N.service
 After=container-build@%N.service

 [Service]
-Restart=always
-EnvironmentFile=/etc/container-service/%N/%N.env
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
-                          --env-file /etc/container-service/%N/%N.env \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+EnvironmentFile=%E/coreos-home-server/%N/%N.env
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --env-file %E/coreos-home-server/%N/%N.env \
                          --volume %N:/var/lib/mysql:z \
                          localhost/%N:latest
-ExecStartPost=/bin/podman run --replace --pull never --rm --name %N-wait --net internal \
-                              --volume %N:/var/lib/mysql:z \
-                              --entrypoint mariadb-admin localhost/%N:latest \
-                              --host mariadb --user root --password=${MYSQL_ROOT_PASSWORD} --wait=30 ping
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N

 [Install]
 WantedBy=multi-user.target
--- a/config/service/nginx/systemd/nginx-proxy-http@.service
+++ b/config/service/nginx/systemd/nginx-proxy-http@.service
@ -7,7 +7,7 @@ After=nginx.service %i.service
 Type=oneshot
 RemainAfterExit=true
 Environment=SERVER_NAME=%i SSL_CERT_NAME=%i UPSTREAM_HOST=%i UPSTREAM_PORT=8080
-Environment=NGINX_CONF=/etc/container-service/nginx/service/%p.conf.template
+Environment=NGINX_CONF=%E/coreos-home-server/nginx/service/%p.conf.template
 ExecStart=/bin/sh -c "envsubst '$SERVER_NAME $SERVER_NAME_ALT $SSL_CERT_NAME $UPSTREAM_HOST $UPSTREAM_PORT' \
                     < ${NGINX_CONF} > /tmp/%i.conf"
 ExecStartPost=/bin/sh -c 'podman cp /tmp/%i.conf nginx:/etc/nginx/conf.d/%i.conf && rm -f /tmp/%i.conf'
--- a/config/service/nginx/systemd/nginx-serve-php@.service
+++ b/config/service/nginx/systemd/nginx-serve-php@.service
@ -5,12 +5,15 @@ After=container-build@%i.service nginx.service
 Before=nginx-proxy-http@%i.service

 [Service]
-Restart=always
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
 Environment=SERVER_NAME=%i SERVICE_DATA_DIRECTORY=/data
-Environment=NGINX_CONF=/etc/container-service/nginx/service/%p.conf.template
+Environment=NGINX_CONF=%E/coreos-home-server/nginx/service/%p.conf.template
 ExecStartPre=/bin/podman pod create --replace --name %i --net internal
-ExecStartPre=/bin/podman create --replace --pull never --name %i-php --pod %i \
-                                --env-file /etc/container-service/%i/%i.env \
+ExecStartPre=/bin/podman create --replace --pull never --name %i-php --pod %i --sdnotify=conmon \
+                                --env-file %E/coreos-home-server/%i/%i.env \
                                --volume %i:${SERVICE_DATA_DIRECTORY}:z,rshared \
                                localhost/%i:latest
 ExecStartPre=/bin/podman init %i-php
@ -20,8 +23,8 @@ ExecStartPre=/bin/podman create --replace --pull never --name %i-nginx --pod %i
 ExecStartPre=/bin/sh -c "envsubst '$SERVER_NAME' < ${NGINX_CONF} > /tmp/%i.conf"
 ExecStartPre=/bin/sh -c 'podman cp /tmp/%i.conf %i-nginx:/etc/nginx/conf.d/%i.conf && rm -f /tmp/%i.conf'
 ExecStart=/bin/sh -c 'podman pod start %i && podman start --attach %i-php'
-ExecStop=/bin/podman pod stop --time 10 %i
-ExecStopPost=/bin/podman pod rm --force %i
+ExecStop=/bin/podman pod stop --ignore --time 10 %i
+ExecStopPost=/bin/podman pod rm --ignore --force %i

 [Install]
 Alias=%i.service
--- a/config/service/nginx/systemd/nginx-serve-static@.service
+++ b/config/service/nginx/systemd/nginx-serve-static@.service
@ -5,17 +5,20 @@ After=container-build@%i.service nginx.service
 Before=nginx-proxy-http@%i.service

 [Service]
-Restart=always
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
 Environment=SERVER_NAME=%i SERVICE_DATA_DIRECTORY=/data
-Environment=NGINX_CONF=/etc/container-service/nginx/service/%p.conf.template
-ExecStartPre=/bin/podman create --replace --pull never --name %i --net internal \
+Environment=NGINX_CONF=%E/coreos-home-server/nginx/service/%p.conf.template
+ExecStartPre=/bin/podman create --replace --pull never --name %i --net internal --sdnotify=conmon \
                                --volume %i:${SERVICE_DATA_DIRECTORY}:z,ro \
                                localhost/%i:latest
 ExecStartPre=/bin/sh -c "envsubst '$SERVER_NAME' < ${NGINX_CONF} > /tmp/%i.conf"
 ExecStartPre=/bin/sh -c 'podman cp /tmp/%i.conf %i:/etc/nginx/conf.d/%i.conf && rm -f /tmp/%i.conf'
 ExecStart=/bin/podman start --attach %i
-ExecStop=/bin/podman stop --time 10 %i
-ExecStopPost=/bin/podman rm --force %i
+ExecStop=/bin/podman stop --ignore --time 10 %i
+ExecStopPost=/bin/podman rm --ignore --force %i

 [Install]
 Alias=%i.service
--- a/config/service/nginx/systemd/nginx.service
+++ b/config/service/nginx/systemd/nginx.service
@ -4,14 +4,17 @@ Wants=container-build@%N.service
 After=container-build@%N.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
                          --publish 80:80 --publish 443:443 \
                          --volume nginx-conf:/etc/nginx/conf.d:z \
                          --volume letsencrypt:/etc/ssl/private:z,rshared,ro \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N
 ExecReload=/bin/podman exec %N %N -s reload

 [Install]
--- a/config/service/postfix/systemd/postfix.service
+++ b/config/service/postfix/systemd/postfix.service
@ -4,15 +4,18 @@ Wants=container-build@%N.service dovecot.service
 After=container-build@%N.service dovecot.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
-                          --env-file /etc/container-service/%N/%N.env \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --env-file %E/coreos-home-server/%N/%N.env \
                          --publish 25:25 --publish 465:465 --publish 587:587 \
                          --volume dovecot:/var/mail:z \
                          --volume letsencrypt:/etc/ssl/private:z \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N
 ExecReload=/bin/podman exec %N %N reload

 [Install]
--- a/config/service/prosody/systemd/prosody.service
+++ b/config/service/prosody/systemd/prosody.service
@ -4,16 +4,19 @@ Wants=container-build@%N.service mariadb.service dovecot.service
 After=container-build@%N.service mariadb.service dovecot.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
-                          --env-file /etc/container-service/%N/%N.env \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --env-file %E/coreos-home-server/%N/%N.env \
                          --publish 5222:5222 --publish 5269:5269 --publish 5347:5347 \
                          --volume %N:/var/lib/%N:z \
                          --volume letsencrypt:/etc/ssl/private:z \
-                          --volume /etc/container-service/%N/service/config:/etc/%N/conf.d:z \
+                          --volume %E/coreos-home-server/%N/service/config:/etc/%N/conf.d:z \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N
 ExecReload=/bin/podman exec %N prosodyctl reload

 [Install]
--- a/config/service/radicale/systemd/radicale.service
+++ b/config/service/radicale/systemd/radicale.service
@ -4,13 +4,16 @@ Wants=container-build@%N.service dovecot.service
 After=container-build@%N.service dovecot.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
-                          --env-file /etc/container-service/%N/%N.env \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --env-file %E/coreos-home-server/%N/%N.env \
                          --volume %N:/var/lib/%N:z \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N

 [Install]
 WantedBy=multi-user.target
--- a/config/service/redis/systemd/redis.service
+++ b/config/service/redis/systemd/redis.service
@ -4,10 +4,15 @@ Wants=container-build@%N.service
 After=container-build@%N.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal --volume %N:/data:z localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --volume %N:/data:z \
+                          localhost/%N:latest
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N

 [Install]
 WantedBy=multi-user.target
--- a/config/service/rspamd/systemd/rspamd.service
+++ b/config/service/rspamd/systemd/rspamd.service
@ -4,13 +4,16 @@ Wants=container-build@%N.service redis.service
 After=container-build@%N.service redis.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
-                          --env-file /etc/container-service/%N/%N.env \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --env-file %E/coreos-home-server/%N/%N.env \
                          --volume %N:/var/lib/%N:z \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N
 ExecReload=/bin/podman exec %N rspamadm reload

 [Install]
--- a/config/service/spectrum/systemd/spectrum.service
+++ b/config/service/spectrum/systemd/spectrum.service
@ -4,13 +4,16 @@ Wants=container-build@%N.service prosody.service
 After=container-build@%N.service prosody.service

 [Service]
-Restart=always
-ExecStart=/bin/podman run --replace --pull never --name %N --net internal \
-                          --env-file /etc/container-service/%N/%N.env \
+Type=notify
+NotifyAccess=all
+Restart=on-failure
+Environment=PODMAN_SYSTEMD_UNIT=%n
+ExecStart=/bin/podman run --replace --pull never --name %N --net internal --sdnotify=conmon \
+                          --env-file %E/coreos-home-server/%N/%N.env \
                          --volume %N:/var/lib/spectrum2:z \
                          localhost/%N:latest
-ExecStop=/bin/podman stop --time 10 %N
-ExecStopPost=/bin/podman rm --force %N
+ExecStop=/bin/podman stop --ignore --time 10 %N
+ExecStopPost=/bin/podman rm --ignore --force %N

 [Install]
 WantedBy=multi-user.target
--- a/host/lhr01nuc/spec.bu
+++ b/host/lhr01nuc/spec.bu
@ -34,7 +34,7 @@ storage:
      contents:
        inline: lhr01nuc

-    - path: /etc/container-service/host.env
+    - path: /etc/coreos-home-server/host.env
      mode: 0600
      contents:
        local: lhr01nuc.env.gpg
--- a/host/virtual/spec.bu
+++ b/host/virtual/spec.bu
@ -88,7 +88,7 @@ storage:
        inline: core-virtual

    # Load host-wide environment into default location.
-    - path: /etc/container-service/host.env
+    - path: /etc/coreos-home-server/host.env
      mode: 0600
      contents:
        local: virtual.env
@ -101,14 +101,14 @@ storage:
          export SYSTEMD_PAGER=cat

    # Example sites for static and PHP setups.
-    - path: /etc/container-service/static.localhost/Containerfile
+    - path: /etc/coreos-home-server/static.localhost/Containerfile
      mode: 0644
      contents:
        inline: |
          FROM localhost/nginx:latest
          RUN /bin/echo "Hello Static World!" > /srv/index.html

-    - path: /etc/container-service/php.localhost/Containerfile
+    - path: /etc/coreos-home-server/php.localhost/Containerfile
      mode: 0644
      contents:
        inline: |
@ -116,7 +116,7 @@ storage:
          RUN /bin/echo "<?php phpinfo();" > /srv/index.php
          VOLUME /data /srv

-    - path: /etc/container-service/php.localhost/php.localhost.env
+    - path: /etc/coreos-home-server/php.localhost/php.localhost.env
      mode: 0644
      contents:
        inline: |