62 lines
1.9 KiB
Desktop File
62 lines
1.9 KiB
Desktop File
# chess-server as a systemd service. Installed by deploy/linux/setup.sh as
|
|
# /etc/systemd/system/chessd.service; settings live in /etc/chessd/chessd.env.
|
|
# Local changes belong in a drop-in (systemctl edit chessd), which setup.sh
|
|
# never overwrites.
|
|
|
|
[Unit]
|
|
Description=Chess API server
|
|
Documentation=https://github.com/lixenwraith/chess/blob/main/doc/deployment-linux.md
|
|
Wants=network-online.target postgresql.service
|
|
After=network-online.target postgresql.service
|
|
# PostgreSQL may still be starting at boot; keep retrying instead of giving up.
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
Type=exec
|
|
User=chess
|
|
Group=chess
|
|
EnvironmentFile=/etc/chessd/chessd.env
|
|
# Stockfish is /usr/games/stockfish on Debian and Ubuntu, /usr/bin elsewhere.
|
|
Environment=PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
|
|
# ${VAR} stays one argument (the DSN has spaces); $CHESSD_FLAGS splits into
|
|
# words and expands to nothing when empty.
|
|
ExecStart=/usr/local/bin/chess-server \
|
|
-api-host ${CHESSD_HOST} -api-port ${CHESSD_PORT} \
|
|
-dsn ${CHESSD_DSN} -jwt-secret-file ${CHESSD_JWT_KEY} \
|
|
-trusted-proxies ${CHESSD_TRUSTED_PROXIES} \
|
|
$CHESSD_FLAGS
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# /var/lib/chessd holds the JWT key; the service can read and write nothing
|
|
# else. PostgreSQL is reached over its Unix socket under /run.
|
|
StateDirectory=chessd
|
|
StateDirectoryMode=0700
|
|
UMask=0077
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectProc=invisible
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|