feat: add commence-restore.service systemd service file

ansible/files/adminapi.sudoers.conf

@@ -36,6 +36,7 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st
 %adminapi ALL= NOPASSWD: /usr/bin/systemctl restart adminapi.service
 %adminapi ALL= NOPASSWD: /usr/bin/systemctl is-active commence-backup.service
 %adminapi ALL= NOPASSWD: /usr/bin/systemctl start commence-backup.service
+%adminapi ALL= NOPASSWD: /usr/bin/systemctl start commence-restore.service
 %adminapi ALL= NOPASSWD: /bin/systemctl daemon-reload
 %adminapi ALL= NOPASSWD: /bin/systemctl restart services.slice
 %adminapi ALL= NOPASSWD: /usr/sbin/nft -f /etc/nftables/supabase_managed.conf

ansible/files/commence-restore.service.j2

@@ -0,0 +1,9 @@
+[Unit]
+Description=Async commence restore of physical backup
+
+[Service]
+Type=notify
+TimeoutStartSec=30
+ExecStart=/usr/bin/admin-mgr commence-restore --run-as-service
+Restart=no
+OOMScoreAdjust=-1000

ansible/tasks/internal/admin-api.yml

@@ -81,8 +81,13 @@
 
 - name: adminapi - create service file for commence backup process
   template:
-     src: files/commence-backup.service.j2
-     dest: /etc/systemd/system/commence-backup.service
+    src: files/commence-backup.service.j2
+    dest: /etc/systemd/system/commence-backup.service
+
+- name: adminapi - create service file for commence restore process
+  template:
+    src: files/commence-restore.service.j2
+    dest: /etc/systemd/system/commence-restore.service
 
 - name: UFW - Allow connections to adminapi ports
   ufw:

audit-specs/baselines/baseline.yml

@@ -5371,6 +5371,12 @@ file:
     owner: "0"
     group: "0"
     filetype: file
+  /etc/systemd/system/commence-restore.service:
+    exists: true
+    mode: "0644"
+    owner: "0"
+    group: "0"
+    filetype: file
   /etc/systemd/system/database-optimizations.service:
     exists: true
     mode: "0644"