39 lines
1.0 KiB
Desktop File
39 lines
1.0 KiB
Desktop File
[Unit]
|
||
Description=Scert Nginx 受限证书激活服务
|
||
Requires=scert-nginx.socket nginx.service
|
||
PartOf=nginx.service
|
||
After=scert-nginx.socket nginx.service
|
||
ConditionPathExists=/etc/scert-nginx/policy.json
|
||
|
||
[Service]
|
||
Type=simple
|
||
User=root
|
||
Group=root
|
||
ExecStart=/usr/local/libexec/scert-nginx --policy /etc/scert-nginx/policy.json
|
||
UMask=0077
|
||
TimeoutStopSec=40
|
||
Restart=on-failure
|
||
RestartSec=5
|
||
NoNewPrivileges=yes
|
||
CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_CHOWN
|
||
AmbientCapabilities=
|
||
PrivateTmp=yes
|
||
PrivateDevices=yes
|
||
ProtectSystem=strict
|
||
ProtectHome=yes
|
||
ProtectHostname=yes
|
||
ProtectClock=yes
|
||
ProtectKernelTunables=yes
|
||
ProtectKernelModules=yes
|
||
ProtectKernelLogs=yes
|
||
ProtectControlGroups=yes
|
||
LockPersonality=yes
|
||
MemoryDenyWriteExecute=yes
|
||
RestrictNamespaces=yes
|
||
RestrictRealtime=yes
|
||
RestrictSUIDSGID=yes
|
||
SystemCallArchitectures=native
|
||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||
# Nginx 配置检查会打开日志和 PID；非标准部署须按实际路径单独评审。
|
||
ReadWritePaths=/var/lib/scert-nginx -/var/log/nginx -/var/lib/nginx -/var/cache/nginx -/run/nginx.pid
|