xuans
0b74886c45
通过本机Unix套接字报告HTTPS监听状态，同步服务配置与安装模板，保持初始化业务就绪隔离。补充生命周期回归并修复旧CLI测试误用正式目录的问题。更新Linux原生测试证据，明确新候选尚未部署、生产验收未放行。
51 lines
1.3 KiB
Desktop File
51 lines
1.3 KiB
Desktop File
[Unit]
|
||
Description=Scert SSL 证书管理核心服务
|
||
Documentation=file:///scert/docs/Scert-service-management.md
|
||
After=network-online.target
|
||
Wants=network-online.target
|
||
Wants=Scert-storage.socket
|
||
After=Scert-storage.socket
|
||
|
||
[Service]
|
||
Type=notify
|
||
NotifyAccess=main
|
||
TimeoutStartSec=90
|
||
User=Scert
|
||
Group=Scert
|
||
WorkingDirectory=/scert
|
||
ExecStart=/scert/scert --config /scert/conf/scert.json serve
|
||
Environment=SCERT_BOOTSTRAP_FIREWALL_MODE=external
|
||
Environment=SCERT_SERVER_HOST=127.0.0.1
|
||
KillSignal=SIGTERM
|
||
TimeoutStopSec=30
|
||
Restart=on-failure
|
||
UMask=0077
|
||
RuntimeDirectory=scert
|
||
RuntimeDirectoryMode=0700
|
||
NoNewPrivileges=yes
|
||
CapabilityBoundingSet=
|
||
AmbientCapabilities=
|
||
PrivateTmp=yes
|
||
PrivateDevices=yes
|
||
ProtectHome=yes
|
||
ProtectSystem=strict
|
||
ProtectHostname=yes
|
||
ProtectClock=yes
|
||
ProtectKernelTunables=yes
|
||
ProtectKernelModules=yes
|
||
ProtectControlGroups=yes
|
||
ProtectKernelLogs=yes
|
||
LockPersonality=yes
|
||
MemoryDenyWriteExecute=yes
|
||
RestrictNamespaces=yes
|
||
RestrictRealtime=yes
|
||
RestrictSUIDSGID=yes
|
||
RemoveIPC=yes
|
||
SystemCallArchitectures=native
|
||
ReadWritePaths=/scert/conf /scert/data /scert/log /scert/backups
|
||
# 初始化临时证书读取本机网卡地址需要 NETLINK_ROUTE，不授予网络管理能力。
|
||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|