diff options
Diffstat (limited to 'pkg/mirumw@.service')
| -rw-r--r-- | pkg/mirumw@.service | 48 | +48 −0 |
1 files changed, 48 insertions, 0 deletions
diff --git a/pkg/mirumw@.service b/pkg/mirumw@.service new file mode 100644 --- /dev/null +++ b/pkg/mirumw@.service @@ -0,0 +1,48 @@ +# Copyright (c) 2026 Nikolay Govorov +# SPDX-License-Identifier: AGPL-3.0-or-later + +[Unit] +Description=Mirum worker %i (modern CI platform) +Requires=network-online.target +After=time-sync.target network-online.target remote-fs.target nss-lookup.target +Wants=time-sync.target + +[Service] +Type=notify +User=mirumw +Group=mirumw +Restart=always +RestartSec=30 +WatchdogSec=30 +NotifyAccess=main +ExecPaths=/usr/local/bin/mirumw +ExecStart=/usr/local/bin/mirumw --config=/etc/mirum/mirumw-%i.yaml +LimitCORE=infinity +LimitNOFILE=500000 +AmbientCapabilities= + +# %p is resolved to the systemd unit name +LogsDirectory=%p +StateDirectory=%p +CacheDirectory=%p +RuntimeDirectory=%p + +UMask=0077 +LockPersonality=yes +NoNewPrivileges=yes +PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=yes +RestrictSUIDSGID=yes + +[Install] +# service should not start from the rescue shell (rescue.target). +WantedBy=multi-user.target |