diff options
Diffstat (limited to 'pkg/mirum-server.service')
| -rw-r--r-- | pkg/mirum-server.service | 64 | +64 −0 |
1 files changed, 64 insertions, 0 deletions
diff --git a/pkg/mirum-server.service b/pkg/mirum-server.service new file mode 100644 --- /dev/null +++ b/pkg/mirum-server.service @@ -0,0 +1,64 @@ +# Copyright (c) 2026 Nikolay Govorov +# SPDX-License-Identifier: AGPL-3.0-or-later + +[Unit] +Description=Mirum daemon (modern CI platform) +Requires=network-online.target +After=time-sync.target network-online.target remote-fs.target nss-lookup.target postgresql.service +Wants=time-sync.target + +# Socket activation (optional): +# Create mirum-server.socket with named file descriptors "web" and "grpc": +# +# [Socket] +# ListenStream=0.0.0.0:3000 +# FileDescriptorName=web +# +# [Socket] +# ListenStream=0.0.0.0:2026 +# FileDescriptorName=grpc +# +# Without socket activation the daemon binds www_addr and grpc_addr from config. + +[Service] +Type=notify +User=mirum-server +Group=mirum-server +Restart=always +RestartSec=30 +WatchdogSec=30 +NotifyAccess=main +ExecPaths=/usr/local/bin/mirum-server /usr/lib +ExecStart=/usr/local/bin/mirum-server daemon --config=/etc/mirum/server/config.yaml +LimitCORE=infinity +LimitNOFILE=500000 +AmbientCapabilities=CAP_NET_BIND_SERVICE + +# %p is resolved to the systemd unit name +LogsDirectory=%p +StateDirectory=%p +CacheDirectory=%p +RuntimeDirectory=%p + +UMask=0077 +LockPersonality=yes +NoNewPrivileges=yes +PrivateDevices=yes +PrivateTmp=true +ProcSubset=pid +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectProc=invisible +ProtectSystem=strict +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=yes +RestrictSUIDSGID=yes + +[Install] +# service should not start from the rescue shell (rescue.target). +WantedBy=multi-user.target |