1 # It is not recommended to modify this file in-place, because it will
2 # be overwritten during package upgrades. If you want to add further
3 # options or overwrite existing ones then use
4 # $ systemctl edit bitcoind.service
5 # See "man systemd.service" for details.
6 7 # Note that almost all daemon options could be specified in
8 # /etc/bitcoin/bitcoin.conf, but keep in mind those explicitly
9 # specified as arguments in ExecStart= will override those in the
10 # config file.
11 12 [Unit]
13 Description=Bitcoin daemon
14 Documentation=https://github.com/bitcoin/bitcoin/blob/master/doc/init.md
15 16 # https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/
17 After=network-online.target
18 Wants=network-online.target
19 20 [Service]
21 ExecStart=/usr/bin/bitcoind -pid=/run/bitcoind/bitcoind.pid \
22 -conf=/etc/bitcoin/bitcoin.conf \
23 -datadir=/var/lib/bitcoind \
24 -startupnotify='systemd-notify --ready' \
25 -shutdownnotify='systemd-notify --stopping'
26 27 # Make sure the config directory is readable by the service user
28 ExecStartPre=!/bin/chgrp bitcoin /etc/bitcoin
29 30 # Process management
31 ####################
32 33 Type=notify
34 NotifyAccess=all
35 PIDFile=/run/bitcoind/bitcoind.pid
36 37 Restart=on-failure
38 TimeoutStartSec=infinity
39 TimeoutStopSec=600
40 41 # Directory creation and permissions
42 ####################################
43 44 # Run as bitcoin:bitcoin
45 User=bitcoin
46 47 # /run/bitcoind
48 RuntimeDirectory=bitcoind
49 RuntimeDirectoryMode=0710
50 51 # /etc/bitcoin
52 ConfigurationDirectory=bitcoin
53 ConfigurationDirectoryMode=0710
54 55 # /var/lib/bitcoind
56 StateDirectory=bitcoind
57 StateDirectoryMode=0710
58 59 # Hardening measures
60 ####################
61 62 # Provide a private /tmp and /var/tmp.
63 PrivateTmp=true
64 65 # Mount /usr, /boot/ and /etc read-only for the process.
66 ProtectSystem=full
67 68 # Deny access to /home, /root and /run/user
69 ProtectHome=true
70 71 # Disallow the process and all of its children to gain
72 # new privileges through execve().
73 NoNewPrivileges=true
74 75 # Use a new /dev namespace only populated with API pseudo devices
76 # such as /dev/null, /dev/zero and /dev/random.
77 PrivateDevices=true
78 79 # Deny the creation of writable and executable memory mappings.
80 MemoryDenyWriteExecute=true
81 82 # Restrict ABIs to help ensure MemoryDenyWriteExecute is enforced
83 SystemCallArchitectures=native
84 85 [Install]
86 WantedBy=multi-user.target
87