systemd

Use the systemd units when Oriel runs on a host or VM and PostgreSQL, ClickHouse, and Valkey are managed outside the Oriel process.

Before you install

• An oriel binary installed on the host
• PostgreSQL, ClickHouse, and Valkey reachable from the host
• deploy/systemd/oriel.service
• deploy/systemd/oriel-migrate.service
• /etc/oriel/oriel.toml

Install the service

Install the binary:

sudo install -m 0755 oriel /usr/local/bin/oriel

Create a service user:

sudo useradd --system --no-create-home --shell /usr/sbin/nologin oriel

Install config:

sudo install -d -m 0755 /etc/oriel
sudo install -m 0640 -o root -g oriel oriel.example.toml /etc/oriel/oriel.toml

Set at least:

[clickhouse]
dsn = "clickhouse://oriel:oriel@clickhouse.example:9000/oriel"

[metadata]
dsn = "postgres://oriel:oriel@postgres.example:5432/oriel"

[valkey]
dsn = "valkey://valkey.example:6379/0"

Install and enable units:

sudo install -m 0644 deploy/systemd/oriel.service deploy/systemd/oriel-migrate.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now oriel.service

oriel.service requires oriel-migrate.service, so migrations run before the long-running process starts.

Check the service

systemctl status oriel-migrate.service
systemctl status oriel.service
journalctl -u oriel.service -f
curl -fsS http://localhost:6743/readyz

Upgrade or recover

To upgrade:

sudo install -m 0755 oriel /usr/local/bin/oriel
sudo systemctl restart oriel.service

To recover a failed schema check, run:

sudo -u oriel oriel --config /etc/oriel/oriel.toml migrate status
sudo -u oriel oriel --config /etc/oriel/oriel.toml migrate up

The units run with NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, an empty capability set, and /var/lib/oriel as the writable state directory.