Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

better example file for systemd service #22

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

better example file for systemd service #22

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 15 additions & 8 deletions go-mmproxy.service.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,17 +5,24 @@ After=network.target
[Service]
Type=simple
LimitNOFILE=65535
ExecStartPost=/sbin/ip rule add from 127.0.0.1/8 iif lo table 123
ExecStartPost=/sbin/ip route add local 0.0.0.0/0 dev lo table 123
ExecStartPost=/sbin/ip -6 rule add from ::1/128 iif lo table 123
ExecStartPost=/sbin/ip -6 route add local ::/0 dev lo table 123
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
ExecStartPost=+/sbin/ip rule add from 127.0.0.1/8 iif lo table 123
ExecStartPost=+/sbin/ip route add local 0.0.0.0/0 dev lo table 123
ExecStartPost=+/sbin/ip -6 rule add from ::1/128 iif lo table 123
ExecStartPost=+/sbin/ip -6 route add local ::/0 dev lo table 123
ExecStart=/usr/bin/go-mmproxy -4 127.0.0.1:1000 -6 "[::1]:1000" -allowed-subnets /usr/share/path-prefixes.txt -l 0.0.0.0:1234
ExecStopPost=/sbin/ip rule del from 127.0.0.1/8 iif lo table 123
ExecStopPost=/sbin/ip route del local 0.0.0.0/0 dev lo table 123
ExecStopPost=/sbin/ip -6 rule del from ::1/128 iif lo table 123
ExecStopPost=/sbin/ip -6 route del local ::/0 dev lo table 123
ExecStopPost=+/sbin/ip rule del from 127.0.0.1/8 iif lo table 123
ExecStopPost=+/sbin/ip route del local 0.0.0.0/0 dev lo table 123
ExecStopPost=+/sbin/ip -6 rule del from ::1/128 iif lo table 123
ExecStopPost=+/sbin/ip -6 route del local ::/0 dev lo table 123
Restart=on-failure
RestartSec=10s
User=nobody
Group=nogroup
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

User and Group should not be set to nobody/nogroup, instead DynamicUser=yes should be used

Environment=USER=nobody HOME=/tmp
ProtectSystem=true
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this should be ProtectSystem=full so that a config file with allowed subnets can be loaded from /etc

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It should be strict, as the service does not need any write access.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It should be strict, as the service does not need any write access.

Yes, you are right.
When using DynamicUser=yes systemd also implicitly sets ProtectSystem=strict according to the systemd documentation.

PrivateTmp=true
WorkingDirectory=/tmp

[Install]
WantedBy=multi-user.target
Expand Down