conduit/debian/matrix-conduit.service

[Unit]
Description=conduwuit Matrix homeserver
After=network-online.target

[Service]
DynamicUser=yes
User=_matrix-conduit
Group=_matrix-conduit
Type=notify

AmbientCapabilities=
CapabilityBoundingSet=

DevicePolicy=closed
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
ProcSubset=pid
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
PrivateDevices=yes
PrivateMounts=yes
PrivateTmp=yes
PrivateUsers=yes
PrivateIPC=yes
RemoveIPC=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @resources @privileged @keyring @ipc
SystemCallErrorNumber=EPERM
StateDirectory=matrix-conduit

RuntimeDirectory=conduit
RuntimeDirectoryMode=0750

Environment="CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml"

ExecStart=/usr/sbin/matrix-conduit
Restart=on-failure
RestartSec=5

TimeoutStopSec=4m
TimeoutStartSec=4m

StartLimitInterval=1m
StartLimitBurst=5

[Install]
WantedBy=multi-user.target
First version of cargo-deb packaging setup 2020-05-31 22:49:07 +02:00			`[Unit]`
raise default systemd unit start/stop timeout default of 90 seconds can be too low if hardware is not very fast and rocksdb compaction or shutdown takes too long Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-21 05:06:18 +01:00			`Description=conduwuit Matrix homeserver`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00			`After=network-online.target`
First version of cargo-deb packaging setup 2020-05-31 22:49:07 +02:00
			`[Service]`
Adjust some files to the AUR patches 2022-05-10 09:26:19 +02:00			`DynamicUser=yes`
First version of cargo-deb packaging setup 2020-05-31 22:49:07 +02:00			`User=_matrix-conduit`
			`Group=_matrix-conduit`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00			`Type=notify`
First version of cargo-deb packaging setup 2020-05-31 22:49:07 +02:00
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 21:37:22 +01:00			`AmbientCapabilities=`
			`CapabilityBoundingSet=`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00
			`DevicePolicy=closed`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 21:37:22 +01:00			`LockPersonality=yes`
			`MemoryDenyWriteExecute=yes`
			`NoNewPrivileges=yes`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00			`ProcSubset=pid`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 21:37:22 +01:00			`ProtectClock=yes`
			`ProtectControlGroups=yes`
			`ProtectHome=yes`
			`ProtectHostname=yes`
			`ProtectKernelLogs=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00			`ProtectProc=invisible`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 21:37:22 +01:00			`ProtectSystem=strict`
			`PrivateDevices=yes`
			`PrivateMounts=yes`
			`PrivateTmp=yes`
			`PrivateUsers=yes`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00			`PrivateIPC=yes`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 21:37:22 +01:00			`RemoveIPC=yes`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00			`RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 21:37:22 +01:00			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`RestrictSUIDSGID=yes`
			`SystemCallArchitectures=native`
			`SystemCallFilter=@system-service`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00			`SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @resources @privileged @keyring @ipc`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 21:37:22 +01:00			`SystemCallErrorNumber=EPERM`
			`StateDirectory=matrix-conduit`

update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00			`RuntimeDirectory=conduit`
			`RuntimeDirectoryMode=0750`

Generate conduit.toml instead of debian environment file Only generate this file once. I am not sure what to do with future upgrades yet. 2021-04-16 22:10:07 +02:00			`Environment="CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml"`
First version of cargo-deb packaging setup 2020-05-31 22:49:07 +02:00
			`ExecStart=/usr/sbin/matrix-conduit`
			`Restart=on-failure`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 02:23:18 +01:00			`RestartSec=5`

raise default systemd unit start/stop timeout default of 90 seconds can be too low if hardware is not very fast and rocksdb compaction or shutdown takes too long Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-21 05:06:18 +01:00			`TimeoutStopSec=4m`
			`TimeoutStartSec=4m`

First version of cargo-deb packaging setup 2020-05-31 22:49:07 +02:00			`StartLimitInterval=1m`
			`StartLimitBurst=5`

			`[Install]`
			`WantedBy=multi-user.target`