52 lines
1.4 KiB
Desktop File
52 lines
1.4 KiB
Desktop File
[Unit]
|
||
Description=Scert SSL 证书管理核心服务
|
||
Documentation=file:///scert/docs/Scert-service-management.md
|
||
After=network-online.target
|
||
Wants=network-online.target
|
||
Wants=Scert-storage.socket
|
||
After=Scert-storage.socket
|
||
|
||
[Service]
|
||
Type=notify
|
||
NotifyAccess=main
|
||
TimeoutStartSec=90
|
||
User=Scert
|
||
Group=Scert
|
||
WorkingDirectory=/scert
|
||
ExecStart=/scert/scert --config /scert/conf/scert.json serve
|
||
Environment=SCERT_BOOTSTRAP_FIREWALL_MODE=external
|
||
Environment=SCERT_SERVER_HOST=127.0.0.1
|
||
KillSignal=SIGTERM
|
||
# 为任务取消、部署回滚及持久化收尾预留时间，超过预算仍由启动恢复处理。
|
||
TimeoutStopSec=180
|
||
Restart=on-failure
|
||
UMask=0077
|
||
RuntimeDirectory=scert
|
||
RuntimeDirectoryMode=0700
|
||
NoNewPrivileges=yes
|
||
CapabilityBoundingSet=
|
||
AmbientCapabilities=
|
||
PrivateTmp=yes
|
||
PrivateDevices=yes
|
||
ProtectHome=yes
|
||
ProtectSystem=strict
|
||
ProtectHostname=yes
|
||
ProtectClock=yes
|
||
ProtectKernelTunables=yes
|
||
ProtectKernelModules=yes
|
||
ProtectControlGroups=yes
|
||
ProtectKernelLogs=yes
|
||
LockPersonality=yes
|
||
MemoryDenyWriteExecute=yes
|
||
RestrictNamespaces=yes
|
||
RestrictRealtime=yes
|
||
RestrictSUIDSGID=yes
|
||
RemoveIPC=yes
|
||
SystemCallArchitectures=native
|
||
ReadWritePaths=/scert/conf /scert/data /scert/log /scert/backups
|
||
# 初始化临时证书读取本机网卡地址需要 NETLINK_ROUTE，不授予网络管理能力。
|
||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|