From b99b489d1601de693f32cb26f5bdf1cb8614313a Mon Sep 17 00:00:00 2001
From: Gab <24553253+gabrix73@users.noreply.github.com>
Date: Mon, 9 Jun 2025 17:03:04 +0200
Subject: Create onion-newsreader.service

---
 onion-newsreader.service | 94 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 onion-newsreader.service

(limited to 'onion-newsreader.service')

diff --git a/onion-newsreader.service b/onion-newsreader.service
new file mode 100644
index 0000000..c35cc2f
--- /dev/null
+++ b/onion-newsreader.service
@@ -0,0 +1,94 @@
+[Unit]
+Description=Onion Newsreader Anonymous NNTP Client
+After=network.target tor.service
+Wants=tor.service
+Documentation=https://github.com/gabrix73/onion-newsreader.git
+
+[Service]
+Type=simple
+User=newsreader
+Group=newsreader
+WorkingDirectory=/opt/onion-newsreader
+ExecStart=/opt/onion-newsreader/bin/onion-newsreader
+ExecReload=/bin/kill -HUP $MAINPID
+EnvironmentFile=/etc/onion-newsreader/environment
+
+# Security
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/onion-newsreader /var/log/onion-newsreader
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+# Restart policy
+Restart=always
+RestartSec=10
+StartLimitInterval=60
+StartLimitBurst=3
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=onion-newsreader
+
+[Install]
+WantedBy=multi-user.target
+mct8:/opt/onion-newsreader/src# nano /etc/systemd/system/onion-newsreader.service 
+mct8:/opt/onion-newsreader/src# systemctl daemon-reload 
+mct8:/opt/onion-newsreader/src# nano /etc/systemd/system/onion-newsreader.service 
+mct8:/opt/onion-newsreader/src# cat /etc/systemd/system/onion-newsreader.service 
+[Unit]
+Description=Onion Newsreader Anonymous NNTP Client
+After=network.target tor.service
+Wants=tor.service
+Documentation=https://github.com/gabrix73/onion-newsreader.git
+
+[Service]
+Type=simple
+User=newsreader
+Group=newsreader
+WorkingDirectory=/opt/onion-newsreader
+ExecStart=/opt/onion-newsreader/bin/onion-newsreader
+ExecReload=/bin/kill -HUP $MAINPID
+EnvironmentFile=/etc/onion-newsreader/environment
+
+# Security
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/onion-newsreader /var/log/onion-newsreader
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+# Restart policy
+Restart=always
+RestartSec=10
+StartLimitInterval=60
+StartLimitBurst=3
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=onion-newsreader
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.3