TudbuT/conduit
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
conduit/debian/conduwuit.service

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

61 lines
1.2 KiB
SYSTEMD
Raw Normal View History

First version of cargo-deb packaging setup
2020-05-31 22:49:07 +02:00
[Unit]
raise default systemd unit start/stop timeout default of 90 seconds can be too low if hardware is not very fast and rocksdb compaction or shutdown takes too long Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-21 05:06:18 +01:00
Description=conduwuit Matrix homeserver
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-10 02:23:18 +01:00
After=network-online.target
First version of cargo-deb packaging setup
2020-05-31 22:49:07 +02:00
[Service]
Adjust some files to the AUR patches
2022-05-10 09:26:19 +02:00
DynamicUser=yes
rename `release_log_level` dev feature to `dev_release_log_level`, some rebranding Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-04-25 06:09:50 +02:00
User=_conduwuit
Group=_conduwuit
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-10 02:23:18 +01:00
Type=notify
First version of cargo-deb packaging setup
2020-05-31 22:49:07 +02:00
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary.
2020-11-13 21:37:22 +01:00
AmbientCapabilities=
CapabilityBoundingSet=
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-10 02:23:18 +01:00
DevicePolicy=closed
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary.
2020-11-13 21:37:22 +01:00
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-10 02:23:18 +01:00
ProcSubset=pid
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary.
2020-11-13 21:37:22 +01:00
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-10 02:23:18 +01:00
ProtectProc=invisible
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary.
2020-11-13 21:37:22 +01:00
ProtectSystem=strict
PrivateDevices=yes
PrivateMounts=yes
PrivateTmp=yes
PrivateUsers=yes
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-10 02:23:18 +01:00
PrivateIPC=yes
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary.
2020-11-13 21:37:22 +01:00
RemoveIPC=yes
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-10 02:23:18 +01:00
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary.
2020-11-13 21:37:22 +01:00
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
add `@resources` to syscall filter in the default systemd unit Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-04-26 02:13:48 +02:00
SystemCallFilter=@system-service @resources
SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary.
2020-11-13 21:37:22 +01:00
SystemCallErrorNumber=EPERM
StateDirectory=matrix-conduit
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-10 02:23:18 +01:00
RuntimeDirectory=conduit
RuntimeDirectoryMode=0750
rename `release_log_level` dev feature to `dev_release_log_level`, some rebranding Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-04-25 06:09:50 +02:00
Environment="CONDUIT_CONFIG=/etc/conduwuit/conduwuit.toml"
First version of cargo-deb packaging setup
2020-05-31 22:49:07 +02:00
rename `release_log_level` dev feature to `dev_release_log_level`, some rebranding Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-04-25 06:09:50 +02:00
ExecStart=/usr/sbin/conduwuit
First version of cargo-deb packaging setup
2020-05-31 22:49:07 +02:00
Restart=on-failure
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-10 02:23:18 +01:00
RestartSec=5
raise default systemd unit start/stop timeout default of 90 seconds can be too low if hardware is not very fast and rocksdb compaction or shutdown takes too long Signed-off-by: strawberry <strawberry@puppygock.gay>
2024-02-21 05:06:18 +01:00
TimeoutStopSec=4m
TimeoutStartSec=4m
First version of cargo-deb packaging setup
2020-05-31 22:49:07 +02:00
StartLimitInterval=1m
StartLimitBurst=5
[Install]
WantedBy=multi-user.target
Reference in a new issue Copy permalink