v0.3.0-prod

packaging/ts3monolith.service

@@ -0,0 +1,51 @@
+[Unit]
+Description=TS3 Monolith - panel TeamSpeak 3 (tworzenie kanalow + statystyki RRD)
+Documentation=https://github.com/linuxiarz/ts3-monolith-go
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=ts3monolith
+Group=ts3monolith
+WorkingDirectory=/var/lib/ts3monolith
+EnvironmentFile=/etc/default/ts3monolith
+ExecStart=/usr/bin/ts3monolith
+Restart=on-failure
+RestartSec=3s
+UMask=0027
+StateDirectory=ts3monolith
+StateDirectoryMode=0750
+
+# Hardening. Usluga nie wymaga zadnych uprawnien poza siecia (TS3 ServerQuery,
+# HTTP) i zapisem do /var/lib/ts3monolith (RRD + wygenerowane wykresy PNG).
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/ts3monolith
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictAddressFamilies=AF_INET AF_INET6
+LockPersonality=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+
+# MemoryDenyWriteExecute=true i SystemCallFilter=~@privileged @resources sa
+# NIE wlaczone celowo: sa znanym zrodlem "code=dumped, signal=SYS" (seccomp
+# zabija proces) dla binarek Go, w przeciwienstwie do np. Rusta/LLVM. Jesli
+# chcesz dokrecic bardziej, wlaczaj je pojedynczo i patrz na
+# `journalctl -u ts3monolith` / `dmesg | grep -i seccomp` po kazdej zmianie.
+
+[Install]
+WantedBy=multi-user.target