57 lines
1.6 KiB
Desktop File
57 lines
1.6 KiB
Desktop File
# systemd unit for figcraft-server; setup in docs/server.md ("Deploy on a Linux server").
|
|
# Install: sudo cp figcraft-server.service /etc/systemd/system/ && sudo systemctl daemon-reload
|
|
# sudo systemctl enable --now figcraft-server
|
|
# Logs: journalctl -u figcraft-server
|
|
|
|
[Unit]
|
|
Description=FigCraft collaboration server
|
|
Documentation=https://github.com/storytold/figcraft/blob/main/docs/server.md
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=figcraft
|
|
Group=figcraft
|
|
ExecStart=/usr/local/bin/figcraft-server --config /etc/figcraft-server/server.toml
|
|
# SIGTERM (systemctl stop/restart) stops it gracefully: open files are saved and compacted, and
|
|
# apps are told the server is restarting (they reconnect when it is back).
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=30
|
|
Restart=on-failure
|
|
RestartSec=2
|
|
# max_connections (512 by default) plus the files kept open.
|
|
LimitNOFILE=4096
|
|
UMask=0077
|
|
|
|
# Hardening: the only writable place is the data directory.
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/figcraft-server
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectProc=invisible
|
|
ProcSubset=pid
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RemoveIPC=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|