diff --git a/systemd_units/update.sh b/systemd_units/update.sh index ebdea30..fc9247d 100755 --- a/systemd_units/update.sh +++ b/systemd_units/update.sh @@ -8,7 +8,7 @@ function prettyPrint() { } # Grab all service names -declare -a services=('caddy' 'goaccess' 'mirror-bot' 'mirror-bot-2' 'mkr-bin' 'uno-bot' 'walls-bot') +declare -a services=('caddy' 'goaccess' 'mirror-bot' 'mirror-bot-2' 'mkr-bin' 'uno-bot' 'walls-bot' 'walls-bot-rs') # Now loop through each service and install it for service in "${services[@]}"; do diff --git a/systemd_units/walls-bot-rs.service b/systemd_units/walls-bot-rs.service new file mode 100644 index 0000000..ef55707 --- /dev/null +++ b/systemd_units/walls-bot-rs.service @@ -0,0 +1,31 @@ +[Unit] +Description=walls-bot-rs service +After=network.target + +[Service] +Restart=on-abort +Type=simple +User=bot +EnvironmentFile=/home/bot/walls-bot-rs/env +WorkingDirectory=/home/bot/walls-bot-rs +ExecStart=/home/bot/.cargo/bin/cargo run +ExecReload=/bin/kill -USR1 $MAINPID +KillMode=mixed +KillSignal=SIGQUIT +TimeoutStopSec=5s + +# Security +PrivateTmp=true +ProtectSystem=full +NoNewPrivileges=true +ProtectControlGroups=true +ProtectKernelModules=true +ProtectKernelTunables=true +PrivateDevices=true +RestrictAddressFamilies=AF_INET AF_INET6 +RestrictNamespaces=true +RestrictRealtime=true +SystemCallArchitectures=native + +[Install] +WantedBy=multi-user.target