msfjarvis/server-config
1
Fork 0
mirror of https://github.com/msfjarvis/server-config synced 2025-08-14 08:17:01 +05:30
Code Issues Projects Releases Packages Wiki Activity Actions

systemd: Configure security options

Browse source 
Signed-off-by: Harsh Shandilya <msfjarvis@gmail.com>
This commit is contained in:
Harsh Shandilya 2019-12-23 17:52:27 +05:30
parent 1f8a7183d4
commit c9b2bf0ad8
No known key found for this signature in database
GPG key ID: C2E74282C2133D62
4 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
systemd_units/daas.service
View file

@ -12,6 +12,10 @@ User=caddy
Group=caddy Group=caddy
ExecStart=/usr/local/bin/daas ExecStart=/usr/local/bin/daas
Restart=always Restart=always
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=full
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

4
systemd_units/gitea.service
View file

@ -15,6 +15,10 @@ WorkingDirectory=/var/lib/gitea/
ExecStart=/usr/local/bin/gitea web -c /etc/gitea/app.ini ExecStart=/usr/local/bin/gitea web -c /etc/gitea/app.ini
Restart=always Restart=always
Environment=USER=git HOME=/home/git GITEA_WORK_DIR=/var/lib/gitea Environment=USER=git HOME=/home/git GITEA_WORK_DIR=/var/lib/gitea
PrivateTmp=true
PrivateDevices=true
ProtectSystem=full
ReadWriteDirectories=/var/lib/gitea
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_NET_BIND_SERVICE

1
systemd_units/mirror-bot-2.service
View file

@ -15,7 +15,6 @@ KillSignal=SIGQUIT
TimeoutStopSec=5s TimeoutStopSec=5s
PrivateTmp=true PrivateTmp=true
PrivateDevices=true PrivateDevices=true
ProtectSystem=full
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

1
systemd_units/mirror-bot.service
View file

@ -15,7 +15,6 @@ KillSignal=SIGQUIT
TimeoutStopSec=5s TimeoutStopSec=5s
PrivateTmp=true PrivateTmp=true
PrivateDevices=true PrivateDevices=true
ProtectSystem=full
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target