mirror/nlnetlabs-routinator
1
0
Fork 0
mirror of https://github.com/NLnetLabs/routinator.git synced 2024-05-19 06:50:04 +00:00
Code Issues Releases Activity
nlnetlabs-routinator/debian/routinator.routinator.service

35 lines
815 B
SYSTEMD
Raw Normal View History

Add systemd unit file
2019-05-23 18:07:31 +02:00
[Unit]
Description=Routinator 3000
Documentation=man:routinator(1)
After=network.target
[Service]
Adjust systemd unit file to new realities
2019-05-29 17:56:21 +02:00
ExecStart=/usr/bin/routinator --config=/etc/routinator/routinator.conf --syslog server
Add systemd unit file
2019-05-23 18:07:31 +02:00
Type=exec
routinator.service: restart the daemon on failure RestartSec was a forgotten statement used while debugging: we actually want the daemon to be restarted on failure.
2019-12-29 16:15:55 +01:00
Restart=on-failure
Let systemd manage Routinator, as trying to drop privileges and ensure correct ownership of directories yourself under systemd seems to constantly come into conflict with systemd. Add a routinator-init script to simplify the user post install experience to reduce the chance of running routinator as the wrong user or with the wrong config file and thereby causing permission denied errors on rpki-cache directory files.
2020-09-29 15:19:12 +02:00
User=routinator
Add systemd unit file
2019-05-23 18:07:31 +02:00
AmbientCapabilities=CAP_NET_BIND_SERVICE
Let systemd manage Routinator, as trying to drop privileges and ensure correct ownership of directories yourself under systemd seems to constantly come into conflict with systemd. Add a routinator-init script to simplify the user post install experience to reduce the chance of running routinator as the wrong user or with the wrong config file and thereby causing permission denied errors on rpki-cache directory files.
2020-09-29 15:19:12 +02:00
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
Add systemd unit file
2019-05-23 18:07:31 +02:00
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=strict
ReadWritePaths=/var/lib/routinator/
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
StateDirectory=routinator
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
[Install]
WantedBy=multi-user.target
Copy Permalink