conduwuit/debian/conduwuit.service

[Unit]
Description=conduwuit Matrix homeserver
Documentation=https://conduwuit.puppyirl.gay/
After=network-online.target

[Service]
DynamicUser=yes
User=conduwuit
Group=conduwuit
Type=notify

Environment="CONDUWUIT_CONFIG=/etc/conduwuit/conduwuit.toml"

ExecStart=/usr/sbin/conduwuit

ReadWritePaths=/var/lib/conduwuit /etc/conduwuit

AmbientCapabilities=
CapabilityBoundingSet=

DevicePolicy=closed
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
ProcSubset=pid
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
PrivateDevices=yes
PrivateMounts=yes
PrivateTmp=yes
PrivateUsers=yes
PrivateIPC=yes
RemoveIPC=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service @resources
SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
SystemCallErrorNumber=EPERM
#StateDirectory=conduwuit

RuntimeDirectory=conduwuit
RuntimeDirectoryMode=0750

Restart=on-failure
RestartSec=5

TimeoutStopSec=2m
TimeoutStartSec=2m

StartLimitInterval=1m
StartLimitBurst=5

[Install]
WantedBy=multi-user.target
First version of cargo-deb packaging setup 2020-05-31 20:49:07 +00:00			`[Unit]`
raise default systemd unit start/stop timeout default of 90 seconds can be too low if hardware is not very fast and rocksdb compaction or shutdown takes too long Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-21 04:06:18 +00:00			`Description=conduwuit Matrix homeserver`
docs: add troubleshooting, maintenance, various improvements and fixes Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-05-09 01:26:05 +00:00			`Documentation=https://conduwuit.puppyirl.gay/`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 01:23:18 +00:00			`After=network-online.target`
First version of cargo-deb packaging setup 2020-05-31 20:49:07 +00:00
			`[Service]`
Adjust some files to the AUR patches 2022-05-10 07:26:19 +00:00			`DynamicUser=yes`
docs: add troubleshooting, maintenance, various improvements and fixes Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-05-09 01:26:05 +00:00			`User=conduwuit`
			`Group=conduwuit`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 01:23:18 +00:00			`Type=notify`
First version of cargo-deb packaging setup 2020-05-31 20:49:07 +00:00
docs: add troubleshooting, maintenance, various improvements and fixes Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-05-09 01:26:05 +00:00			`Environment="CONDUWUIT_CONFIG=/etc/conduwuit/conduwuit.toml"`

			`ExecStart=/usr/sbin/conduwuit`

fix up systemd unit file, remove chown on config file for debian Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-05-15 17:34:23 +00:00			`ReadWritePaths=/var/lib/conduwuit /etc/conduwuit`

Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 20:37:22 +00:00			`AmbientCapabilities=`
			`CapabilityBoundingSet=`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 01:23:18 +00:00
			`DevicePolicy=closed`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 20:37:22 +00:00			`LockPersonality=yes`
			`MemoryDenyWriteExecute=yes`
			`NoNewPrivileges=yes`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 01:23:18 +00:00			`ProcSubset=pid`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 20:37:22 +00:00			`ProtectClock=yes`
			`ProtectControlGroups=yes`
			`ProtectHome=yes`
			`ProtectHostname=yes`
			`ProtectKernelLogs=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 01:23:18 +00:00			`ProtectProc=invisible`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 20:37:22 +00:00			`ProtectSystem=strict`
			`PrivateDevices=yes`
			`PrivateMounts=yes`
			`PrivateTmp=yes`
			`PrivateUsers=yes`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 01:23:18 +00:00			`PrivateIPC=yes`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 20:37:22 +00:00			`RemoveIPC=yes`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 01:23:18 +00:00			`RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 20:37:22 +00:00			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`RestrictSUIDSGID=yes`
			`SystemCallArchitectures=native`
add `@resources` to syscall filter in the default systemd unit Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-04-26 00:13:48 +00:00			`SystemCallFilter=@system-service @resources`
			`SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 20:37:22 +00:00			`SystemCallErrorNumber=EPERM`
fix up systemd unit file, remove chown on config file for debian Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-05-15 17:34:23 +00:00			`#StateDirectory=conduwuit`
Lock down the Conduit process in the systemd unit This will secure the service more and allow only what is necessary. 2020-11-13 20:37:22 +00:00
fix up systemd unit file, remove chown on config file for debian Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-05-15 17:34:23 +00:00			`RuntimeDirectory=conduwuit`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 01:23:18 +00:00			`RuntimeDirectoryMode=0750`

First version of cargo-deb packaging setup 2020-05-31 20:49:07 +00:00			`Restart=on-failure`
update debian systemd unit to use notify and harden/update it more Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-10 01:23:18 +00:00			`RestartSec=5`

fix up systemd unit file, remove chown on config file for debian Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-05-15 17:34:23 +00:00			`TimeoutStopSec=2m`
			`TimeoutStartSec=2m`
raise default systemd unit start/stop timeout default of 90 seconds can be too low if hardware is not very fast and rocksdb compaction or shutdown takes too long Signed-off-by: strawberry <strawberry@puppygock.gay> 2024-02-21 04:06:18 +00:00
First version of cargo-deb packaging setup 2020-05-31 20:49:07 +00:00			`StartLimitInterval=1m`
			`StartLimitBurst=5`

			`[Install]`
			`WantedBy=multi-user.target`