You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

40 lines
1.0 KiB

  1. [Unit]
  2. Description=ACME client daemon
  3. After=network.target
  4. ConditionPathExists=/etc/acmed/acmed.toml
  5. Documentation=man:acmed.toml(5) man:acmed(8) https://github.com/breard-r/acmed/wiki
  6. [Service]
  7. User=acmed
  8. Group=acmed
  9. # Working directory (acmed home path)
  10. WorkingDirectory=/var/lib/acmed
  11. RuntimeDirectory=acmed
  12. # daemon handling: start, stop, timeouts
  13. ExecStart=/usr/bin/acmed --foreground --config /etc/acmed/acmed.toml --pid-file /run/acmed/acmed.pid --log-syslog --log-level info
  14. TimeoutStartSec=3
  15. TimeoutStopSec=5
  16. Restart=on-failure
  17. KillSignal=SIGINT
  18. # Sandboxing: reduce privileges on filesystem and kernel-space
  19. # restrict write access to acmed's directories with variable data
  20. NoNewPrivileges=yes
  21. PrivateDevices=yes
  22. PrivateTmp=yes
  23. PrivateUsers=yes
  24. ProtectClock=yes
  25. ProtectHostname=yes
  26. ProtectKernelTunables=yes
  27. ProtectKernelModules=yes
  28. ProtectKernelLogs=yes
  29. ProtectSystem=yes
  30. ReadWritePaths=/etc/acmed /var/lib/acmed
  31. RestrictRealtime=yes
  32. RestrictSUIDSGID=yes
  33. SystemCallFilter=@system-service
  34. [Install]
  35. WantedBy=multi-user.target