mirror of https://github.com/breard-r/acmed.git
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
40 lines
1.0 KiB
40 lines
1.0 KiB
[Unit]
|
|
Description=ACME client daemon
|
|
After=network.target
|
|
ConditionPathExists=/etc/acmed/acmed.toml
|
|
Documentation=man:acmed.toml(5) man:acmed(8) https://github.com/breard-r/acmed/wiki
|
|
|
|
[Service]
|
|
User=acmed
|
|
Group=acmed
|
|
|
|
# Working directory (acmed home path)
|
|
WorkingDirectory=/var/lib/acmed
|
|
RuntimeDirectory=acmed
|
|
|
|
# daemon handling: start, stop, timeouts
|
|
ExecStart=/usr/bin/acmed --foreground --config /etc/acmed/acmed.toml --pid-file /run/acmed/acmed.pid --log-syslog --log-level info
|
|
TimeoutStartSec=3
|
|
TimeoutStopSec=5
|
|
Restart=on-failure
|
|
KillSignal=SIGINT
|
|
|
|
# Sandboxing: reduce privileges on filesystem and kernel-space
|
|
# restrict write access to acmed's directories with variable data
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
PrivateUsers=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectSystem=yes
|
|
ReadWritePaths=/etc/acmed /var/lib/acmed
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
SystemCallFilter=@system-service
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|