48 lines
1.3 KiB
Desktop File
48 lines
1.3 KiB
Desktop File
[Unit]
|
||
Description=Scert-admin 临时密码重置入口激活器
|
||
Documentation=file:///scert/docs/Scert-admin-service-management.md
|
||
After=network-online.target
|
||
Wants=network-online.target
|
||
ConditionPathExists=/scert/conf/scert.json
|
||
|
||
[Service]
|
||
Type=simple
|
||
User=Scert
|
||
Group=Scert
|
||
WorkingDirectory=/scert
|
||
RuntimeDirectory=scert-admin
|
||
RuntimeDirectoryMode=0700
|
||
ExecStart=/scert/scert-admin --config /scert/conf/scert.json --code-output /run/scert-admin/reset-code
|
||
KillSignal=SIGTERM
|
||
TimeoutStopSec=15
|
||
Restart=no
|
||
RuntimeMaxSec=30min
|
||
UMask=0077
|
||
NoNewPrivileges=yes
|
||
CapabilityBoundingSet=
|
||
AmbientCapabilities=
|
||
PrivateTmp=yes
|
||
PrivateDevices=yes
|
||
PrivateNetwork=yes
|
||
ProtectHome=yes
|
||
ProtectSystem=strict
|
||
ProtectHostname=yes
|
||
ProtectClock=yes
|
||
ProtectKernelTunables=yes
|
||
ProtectKernelModules=yes
|
||
ProtectControlGroups=yes
|
||
ProtectKernelLogs=yes
|
||
LockPersonality=yes
|
||
MemoryDenyWriteExecute=yes
|
||
RestrictNamespaces=yes
|
||
RestrictRealtime=yes
|
||
RestrictSUIDSGID=yes
|
||
RemoveIPC=yes
|
||
SystemCallArchitectures=native
|
||
ReadWritePaths=/scert/data /scert/log /run/scert-admin
|
||
RestrictAddressFamilies=AF_UNIX
|
||
|
||
# Scert-admin 不监听任何 TCP/UDP 端口，只维护主服务 /reset 路径的短时激活租约。
|
||
# 刻意不提供 [Install] 段，禁止通过 systemctl enable 纳入开机启动。
|
||
# 不配置 ExecReload，reload 不属于受支持的控制操作。
|