Sam Jeston
History
46 lines·
1.5 KB
| 1 | # systemd unit for openhub, installed by packaging/linux/install.sh |
| 2 | # (scripts/deploy-server.sh runs it for you). Serves the web interface on |
| 3 | # loopback for a TLS-terminating proxy or tunnel on the same machine, and SSH |
| 4 | # on every interface. Set OPENHUB_* variables (at least OPENHUB_PUBLIC_URL) in |
| 5 | # /etc/default/openhub, then restart the service. |
| 6 | [Unit] |
| 7 | Description=Openhub git server |
| 8 | After=network-online.target |
| 9 | Wants=network-online.target |
| 10 | # Keep retrying forever, e.g. while a disk is still mounting after a power cut. |
| 11 | StartLimitIntervalSec=0 |
| 12 | |
| 13 | [Service] |
| 14 | User=openhub |
| 15 | Group=openhub |
| 16 | Environment=OPENHUB_DATA_DIR=/var/lib/openhub |
| 17 | Environment=OPENHUB_HTTP_ADDR=127.0.0.1:3000 |
| 18 | Environment=OPENHUB_SSH_ADDR=0.0.0.0:2222 |
| 19 | # Make git fsync objects and refs, so a power cut just after a push can't leave |
| 20 | # a ref pointing at an object that never reached the disk. |
| 21 | Environment=GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.fsync GIT_CONFIG_VALUE_0=committed |
| 22 | # The journal doesn't render colour codes. |
| 23 | Environment=NO_COLOR=1 |
| 24 | EnvironmentFile=-/etc/default/openhub |
| 25 | ExecStart=/usr/local/bin/openhub |
| 26 | Restart=always |
| 27 | RestartSec=2 |
| 28 | StateDirectory=openhub |
| 29 | StateDirectoryMode=0750 |
| 30 | |
| 31 | NoNewPrivileges=yes |
| 32 | ProtectSystem=strict |
| 33 | ProtectHome=yes |
| 34 | PrivateTmp=yes |
| 35 | PrivateDevices=yes |
| 36 | ProtectKernelTunables=yes |
| 37 | ProtectKernelModules=yes |
| 38 | ProtectControlGroups=yes |
| 39 | RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX |
| 40 | RestrictNamespaces=yes |
| 41 | LockPersonality=yes |
| 42 | MemoryDenyWriteExecute=yes |
| 43 | SystemCallArchitectures=native |
| 44 | |
| 45 | [Install] |
| 46 | WantedBy=multi-user.target |