1
0

mastodon-streaming@.service 1.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354
  1. [Unit]
  2. Description=mastodon-streaming on port %I
  3. After=network.target
  4. # handles using `systemctl restart mastodon-streaming`
  5. PartOf=mastodon-streaming.service
  6. ReloadPropagatedFrom=mastodon-streaming.service
  7. [Service]
  8. Type=simple
  9. User=mastodon
  10. WorkingDirectory=/home/mastodon/live
  11. Environment="NODE_ENV=production"
  12. Environment="PORT=%i"
  13. ExecStart=/usr/bin/node ./streaming
  14. TimeoutSec=15
  15. Restart=always
  16. LimitNOFILE=65536
  17. # Proc filesystem
  18. ProcSubset=pid
  19. ProtectProc=invisible
  20. # Capabilities
  21. CapabilityBoundingSet=
  22. # Security
  23. NoNewPrivileges=true
  24. # Sandboxing
  25. ProtectSystem=strict
  26. PrivateTmp=true
  27. PrivateDevices=true
  28. PrivateUsers=true
  29. ProtectHostname=true
  30. ProtectKernelLogs=true
  31. ProtectKernelModules=true
  32. ProtectKernelTunables=true
  33. ProtectControlGroups=true
  34. RestrictAddressFamilies=AF_INET
  35. RestrictAddressFamilies=AF_INET6
  36. RestrictAddressFamilies=AF_NETLINK
  37. RestrictAddressFamilies=AF_UNIX
  38. RestrictNamespaces=true
  39. LockPersonality=true
  40. RestrictRealtime=true
  41. RestrictSUIDSGID=true
  42. RemoveIPC=true
  43. PrivateMounts=true
  44. ProtectClock=true
  45. # System Call Filtering
  46. SystemCallArchitectures=native
  47. SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @memlock @mount @obsolete @privileged @resources @setuid
  48. SystemCallFilter=pipe
  49. SystemCallFilter=pipe2
  50. ReadWritePaths=/home/mastodon/live
  51. [Install]
  52. WantedBy=multi-user.target mastodon-streaming.service