apps/cunicu
1
0
Fork 0
mirror of https://codeberg.org/cunicu/cunicu.git synced 2025-09-26 21:01:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: Update systemd service file

Browse Source 
Signed-off-by: Steffen Vogel <post@steffenvogel.de>
This commit is contained in:
Steffen Vogel
2025-01-01 22:59:17 +01:00
parent 3bee839348
commit c38140b8b2
1 changed files with 41 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
etc/systemd/cunicu.service
View File

@@ -1,15 +1,52 @@
# SPDX-FileCopyrightText: 2023-2024 Steffen Vogel <post@steffenvogel.de>
# SPDX-FileCopyrightText: 2023-2025 Steffen Vogel <post@steffenvogel.de>
# SPDX-License-Identifier: Apache-2.0
[Unit]
Description=WireGuard Interactive Connectivity Establishment
Description=cunīcu mesh network daemon
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
ExecStart=cunicu daemon
Type=notify-reload
ExecStart=cunicu daemon --log-level debug10 --config /etc/cunicu/cunicu.yaml
Environment="CUNICU_EXPERIMENTAL=1"
Environment="CUNICU_CONFIG_ALLOW_INSECURE=1"
DynamicUser=yes
NotifyAccess=main
WatchdogSec=10
RuntimeDirectory=cunicu
StateDirectory=cunicu
ConfigurationDirectory=cunicu
# Hardening
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_MODULE
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_MODULE
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateUsers=yes
PrivateMounts=yes
PrivateTmp=yes
ProcSubset=pid
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native
[Install]
WantedBy=multi-user.target