From fc60ab416e23143f0d9763590edb6fd46f4f8616cb9d263d7f6e79644f78d98a Mon Sep 17 00:00:00 2001
From: localhorst <localhorst@mosad.xyz>
Date: Thu, 13 Aug 2026 18:44:15 +0200
Subject: [PATCH] fix export of jsons

---
 config.py                       |  6 ++----
 vw-eu-data-act-exporter.service | 13 +++++--------
 2 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/config.py b/config.py
index 9c3c2a5..1f8350b 100644
--- a/config.py
+++ b/config.py
@@ -48,10 +48,8 @@ scrape_interval_minutes = 15
 # carry one. ZIP files themselves are never written to disk. Disabled by
 # default, since the exporter is designed to be stateless (see README.md).
 persist_raw_json = False
-# Under the systemd unit, StateDirectory=vw-eu-data-act-exporter makes
-# systemd export $STATE_DIRECTORY (an already-created, correctly-owned
-# directory) - fall back to a relative path for ad-hoc/local runs.
-persist_raw_json_dir = os.environ.get("STATE_DIRECTORY", "./raw_json")
+# Under the systemd unit enable ProtectSystem=strict if exporting of jsons is not needed
+persist_raw_json_dir = "raw_json"
 
 # --- Logging ---------------------------------------------------------------
 log_level = "INFO"
diff --git a/vw-eu-data-act-exporter.service b/vw-eu-data-act-exporter.service
index 7362885..dc6c97c 100644
--- a/vw-eu-data-act-exporter.service
+++ b/vw-eu-data-act-exporter.service
@@ -13,15 +13,8 @@ Restart=on-failure
 RestartSec=30
 
 # Hardening
-# StateDirectory is created automatically (with correct ownership) before
-# the service starts and is writable under ProtectSystem=strict without a
-# ReadWritePaths= entry - systemd exposes its absolute path via
-# $STATE_DIRECTORY, which config.py picks up for persist_raw_json_dir.
-# Unlike ReadWritePaths=, this does not require the directory to already
-# exist on disk.
-StateDirectory=vw-eu-data-act-exporter
 NoNewPrivileges=true
-ProtectSystem=strict
+#ProtectSystem=strict #Enable this if exporting jsons is not needed
 ProtectHome=true
 PrivateTmp=true
 PrivateDevices=true
@@ -30,5 +23,9 @@ ProtectKernelModules=true
 ProtectControlGroups=true
 RestrictSUIDSGID=true
 
+# Resource limits
+MemoryMax=256M
+CPUQuota=10%
+
 [Install]
 WantedBy=multi-user.target