limenkad.service raw

   1  # It is not recommended to modify this file in-place, because it will
   2  # be overwritten during package upgrades. If you want to add further
   3  # options or overwrite existing ones then use
   4  # $ systemctl edit limenkad.service
   5  # See "man systemd.service" for details.
   6  
   7  # Note that almost all daemon options could be specified in
   8  # /etc/limenka/limenka.conf, but keep in mind those explicitly
   9  # specified as arguments in ExecStart= will override those in the
  10  # config file.
  11  
  12  [Unit]
  13  Description=Limenka daemon
  14  Documentation=https://github.com/limenka/limenka/blob/master/doc/init.md
  15  
  16  # https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/
  17  After=network-online.target
  18  Wants=network-online.target
  19  
  20  [Service]
  21  ExecStart=/usr/bin/limenkad -pid=/run/limenkad/limenkad.pid \
  22                              -conf=/etc/limenka/limenka.conf \
  23                              -datadir=/var/lib/limenkad \
  24                              -startupnotify='systemd-notify --ready' \
  25                              -shutdownnotify='systemd-notify --stopping'
  26  
  27  # Make sure the config directory is readable by the service user
  28  PermissionsStartOnly=true
  29  ExecStartPre=/bin/chgrp limenka /etc/limenka
  30  
  31  # Process management
  32  ####################
  33  
  34  Type=notify
  35  NotifyAccess=all
  36  PIDFile=/run/limenkad/limenkad.pid
  37  
  38  Restart=on-failure
  39  TimeoutStartSec=infinity
  40  TimeoutStopSec=600
  41  
  42  # Directory creation and permissions
  43  ####################################
  44  
  45  # Run as limenka:limenka
  46  User=limenka
  47  Group=limenka
  48  
  49  # /run/limenkad
  50  RuntimeDirectory=limenkad
  51  RuntimeDirectoryMode=0710
  52  
  53  # /etc/limenka
  54  ConfigurationDirectory=limenka
  55  ConfigurationDirectoryMode=0710
  56  
  57  # /var/lib/limenkad
  58  StateDirectory=limenkad
  59  StateDirectoryMode=0710
  60  
  61  # Hardening measures
  62  ####################
  63  
  64  # Provide a private /tmp and /var/tmp.
  65  PrivateTmp=true
  66  
  67  # Mount /usr, /boot/ and /etc read-only for the process.
  68  ProtectSystem=full
  69  
  70  # Deny access to /home, /root and /run/user
  71  ProtectHome=true
  72  
  73  # Disallow the process and all of its children to gain
  74  # new privileges through execve().
  75  NoNewPrivileges=true
  76  
  77  # Use a new /dev namespace only populated with API pseudo devices
  78  # such as /dev/null, /dev/zero and /dev/random.
  79  PrivateDevices=true
  80  
  81  # Deny the creation of writable and executable memory mappings.
  82  MemoryDenyWriteExecute=true
  83  
  84  # Restrict ABIs to help ensure MemoryDenyWriteExecute is enforced
  85  SystemCallArchitectures=native
  86  
  87  [Install]
  88  WantedBy=multi-user.target
  89