You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

51 lines
1.2 KiB

  1. [Unit]
  2. Description=mastodon-streaming
  3. After=network.target
  4. [Service]
  5. Type=simple
  6. User=mastodon
  7. WorkingDirectory=/home/mastodon/live
  8. Environment="NODE_ENV=production"
  9. Environment="PORT=4000"
  10. Environment="STREAMING_CLUSTER_NUM=1"
  11. ExecStart=/usr/bin/node ./streaming
  12. TimeoutSec=15
  13. Restart=always
  14. # Proc filesystem
  15. ProcSubset=pid
  16. ProtectProc=invisible
  17. # Capabilities
  18. CapabilityBoundingSet=
  19. # Security
  20. NoNewPrivileges=true
  21. # Sandboxing
  22. ProtectSystem=strict
  23. PrivateTmp=true
  24. PrivateDevices=true
  25. PrivateUsers=true
  26. ProtectHostname=true
  27. ProtectKernelLogs=true
  28. ProtectKernelModules=true
  29. ProtectKernelTunables=true
  30. ProtectControlGroups=true
  31. RestrictAddressFamilies=AF_INET
  32. RestrictAddressFamilies=AF_INET6
  33. RestrictAddressFamilies=AF_NETLINK
  34. RestrictAddressFamilies=AF_UNIX
  35. RestrictNamespaces=true
  36. LockPersonality=true
  37. RestrictRealtime=true
  38. RestrictSUIDSGID=true
  39. RemoveIPC=true
  40. PrivateMounts=true
  41. ProtectClock=true
  42. # System Call Filtering
  43. SystemCallArchitectures=native
  44. SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @memlock @mount @obsolete @privileged @resources @setuid
  45. SystemCallFilter=pipe
  46. SystemCallFilter=pipe2
  47. ReadWritePaths=/home/mastodon/live
  48. [Install]
  49. WantedBy=multi-user.target