diff options
Diffstat (limited to 'pkg/zorian.service')
| -rw-r--r-- | pkg/zorian.service | 48 | +48 −0 |
1 files changed, 48 insertions, 0 deletions
diff --git a/pkg/zorian.service b/pkg/zorian.service new file mode 100644 --- /dev/null +++ b/pkg/zorian.service @@ -0,0 +1,48 @@ +# SPDX-FileCopyrightText: 2026 Nikolay Govorov <me@govorov.online> +# SPDX-License-Identifier: AGPL-3.0-or-later + +[Unit] +Description=Zorian server (tiny packages caching proxy) +Requires=network-online.target +After=time-sync.target network-online.target remote-fs.target nss-lookup.target +Wants=time-sync.target + +[Service] +Type=exec +User=zorian +Group=zorian +Restart=always +RestartSec=30 +ExecPaths=/usr/local/bin/zorian /usr/lib +ExecStart=/usr/local/bin/zorian --config=/etc/zorian.toml +LimitCORE=infinity +LimitNOFILE=500000 + +# %p is resolved to the systemd unit name +LogsDirectory=%p +StateDirectory=%p +CacheDirectory=%p +RuntimeDirectory=%p + +LockPersonality=yes +NoNewPrivileges=yes +PrivateDevices=yes +PrivateTmp=true +ProcSubset=pid +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectProc=invisible +ProtectSystem=strict +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=yes +RestrictSUIDSGID=yes +UMask=0077 + +[Install] +# service should not start from the rescue shell (rescue.target). +WantedBy=multi-user.target |