56 lines
1.4 KiB
Desktop File
56 lines
1.4 KiB
Desktop File
[Unit]
|
|
Description=JWeBot isolated extension host for %i
|
|
After=local-fs.target
|
|
Requires=jwebot-extension-host@%i.socket
|
|
ConditionPathExists=/etc/jwebot-extension-host/allowed_signers
|
|
|
|
[Service]
|
|
Type=exec
|
|
User=jwebot-ext
|
|
Group=jwebot-ext
|
|
Environment=PYTHONDONTWRITEBYTECODE=1
|
|
ExecStart=/opt/jwebot-extension-host/venv/bin/python -I -m jwebot_extension_host --release-dir /var/lib/jwebot-extensions/%i/current --allowed-signers /etc/jwebot-extension-host/allowed_signers
|
|
WorkingDirectory=/
|
|
StandardInput=socket
|
|
StandardOutput=socket
|
|
StandardError=journal
|
|
Restart=no
|
|
TimeoutStartSec=12s
|
|
RuntimeMaxSec=12s
|
|
UMask=0077
|
|
|
|
NoNewPrivileges=true
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
PrivateNetwork=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ProtectClock=true
|
|
ProtectControlGroups=true
|
|
ProtectHostname=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
ProtectProc=invisible
|
|
ProcSubset=pid
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
RestrictAddressFamilies=AF_UNIX
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @raw-io @reboot @swap
|
|
|
|
MemoryMax=128M
|
|
CPUQuota=50%
|
|
TasksMax=16
|
|
LimitNOFILE=64
|
|
LimitNPROC=16
|
|
LimitCORE=0
|
|
|
|
ReadOnlyPaths=/var/lib/jwebot-extensions/%i
|
|
InaccessiblePaths=/home /root /srv /mnt /media
|