| 1 | # Steid as a systemd service. |
| 2 | # |
| 3 | # This is the reference copy, for the manual installation path in README.md. |
| 4 | # install.sh writes an identical file to /etc/systemd/system/steid.service — |
| 5 | # if you change one, change the other. |
| 6 | # |
| 7 | # Assumes the layout install.sh creates: |
| 8 | # /opt/steid/steid the binary |
| 9 | # /opt/steid/assets/ the asset bundle, which MUST sit beside the binary |
| 10 | # /var/lib/steid/ all state: the SQLite database and the bare repos |
| 11 | # /etc/steid/steid.env configuration |
| 12 | |
| 13 | [Unit] |
| 14 | Description=Steid |
| 15 | Documentation=https://jpgill.dev/jamesgill/repos/steid |
| 16 | After=network-online.target |
| 17 | Wants=network-online.target |
| 18 | |
| 19 | [Service] |
| 20 | Type=simple |
| 21 | User=steid |
| 22 | Group=steid |
| 23 | |
| 24 | # WorkingDirectory is /opt/steid, where nothing is written. The asset bundle is |
| 25 | # found either way — `AssetBundle::load()` resolves relative to the executable, |
| 26 | # verified by running the binary from `/` — but `dotenvy` reads `.env` from the |
| 27 | # *working directory*, so pointing this at the state directory would let a file |
| 28 | # dropped there silently override the configuration below. |
| 29 | WorkingDirectory=/opt/steid |
| 30 | ExecStart=/opt/steid/steid |
| 31 | EnvironmentFile=/etc/steid/steid.env |
| 32 | |
| 33 | # git reads and writes config relative to HOME, and it is not optional: without |
| 34 | # it git warns, and in some setups fails, on every subprocess Steid spawns. |
| 35 | Environment=HOME=/var/lib/steid |
| 36 | |
| 37 | Restart=on-failure |
| 38 | RestartSec=2s |
| 39 | |
| 40 | # Hardening. Steid needs exactly one writable path, executes git from /usr, and |
| 41 | # talks to nothing but the loopback listener, so most of this is free. |
| 42 | NoNewPrivileges=true |
| 43 | PrivateTmp=true |
| 44 | PrivateDevices=true |
| 45 | ProtectSystem=strict |
| 46 | ProtectHome=true |
| 47 | ProtectKernelTunables=true |
| 48 | ProtectKernelModules=true |
| 49 | ProtectControlGroups=true |
| 50 | RestrictSUIDSGID=true |
| 51 | RestrictNamespaces=true |
| 52 | LockPersonality=true |
| 53 | RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX |
| 54 | ReadWritePaths=/var/lib/steid |
| 55 | |
| 56 | [Install] |
| 57 | WantedBy=multi-user.target |