blob: c35cc2fb190e55fe00f937fdc6b3406fff258290 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
[Unit]
Description=Onion Newsreader Anonymous NNTP Client
After=network.target tor.service
Wants=tor.service
Documentation=https://github.com/gabrix73/onion-newsreader.git
[Service]
Type=simple
User=newsreader
Group=newsreader
WorkingDirectory=/opt/onion-newsreader
ExecStart=/opt/onion-newsreader/bin/onion-newsreader
ExecReload=/bin/kill -HUP $MAINPID
EnvironmentFile=/etc/onion-newsreader/environment
# Security
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/onion-newsreader /var/log/onion-newsreader
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
# Restart policy
Restart=always
RestartSec=10
StartLimitInterval=60
StartLimitBurst=3
# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=onion-newsreader
[Install]
WantedBy=multi-user.target
mct8:/opt/onion-newsreader/src# nano /etc/systemd/system/onion-newsreader.service
mct8:/opt/onion-newsreader/src# systemctl daemon-reload
mct8:/opt/onion-newsreader/src# nano /etc/systemd/system/onion-newsreader.service
mct8:/opt/onion-newsreader/src# cat /etc/systemd/system/onion-newsreader.service
[Unit]
Description=Onion Newsreader Anonymous NNTP Client
After=network.target tor.service
Wants=tor.service
Documentation=https://github.com/gabrix73/onion-newsreader.git
[Service]
Type=simple
User=newsreader
Group=newsreader
WorkingDirectory=/opt/onion-newsreader
ExecStart=/opt/onion-newsreader/bin/onion-newsreader
ExecReload=/bin/kill -HUP $MAINPID
EnvironmentFile=/etc/onion-newsreader/environment
# Security
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/onion-newsreader /var/log/onion-newsreader
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
# Restart policy
Restart=always
RestartSec=10
StartLimitInterval=60
StartLimitBurst=3
# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=onion-newsreader
[Install]
WantedBy=multi-user.target
|
