/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
1
[Unit]
2
Description=Server of encrypted passwords to Mandos clients
734 by Teddy Hogeborn
* mandos.service ([Unit]/Documentation): New.
3
Documentation=man:intro(8mandos) man:mandos(8)
787 by Teddy Hogeborn
Depend on Avahi and the network in the server's systemd service file.
4
## If the server is configured to listen to a specific IP or network
5
## interface, it may be necessary to change "network.target" to
6
## "network-online.target".
7
After=network.target
8
## If the server is configured to not use ZeroConf, these two lines
9
## become unnecessary and should be removed or commented out.
10
After=avahi-daemon.service
887 by Teddy Hogeborn
"RequisiteOverridable" is deprecated in systemd unit files
11
Requisite=avahi-daemon.service
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
12
13
[Service]
787 by Teddy Hogeborn
Depend on Avahi and the network in the server's systemd service file.
14
## If the server's D-Bus interface is disabled, the "BusName" setting
15
## should be removed or commented out.
761 by Teddy Hogeborn
mandos.service: Use Type=dbus (implicitly).
16
BusName=se.recompile.Mandos
1203 by teddy at recompile
Allow users to more easily alter mandos.service
17
EnvironmentFile=/etc/default/mandos
18
ExecStart=/usr/sbin/mandos --foreground $DAEMON_ARGS
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
19
Restart=always
757 by Teddy Hogeborn
mandos.service ([Service]/KillMode): Changed to "mixed".
20
KillMode=mixed
761 by Teddy Hogeborn
mandos.service: Use Type=dbus (implicitly).
21
## Using socket activation won't work, because systemd always does
22
## bind() on the socket, and also won't announce the ZeroConf service.
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
23
#ExecStart=/usr/sbin/mandos --foreground --socket=0
24
#StandardInput=socket
818 by Teddy Hogeborn
Restrict the Mandos server daemon in the systemd service file.
25
# Restrict what the Mandos daemon can do.  Note that this also affects
26
# "checker" programs!
27
PrivateTmp=yes
28
PrivateDevices=yes
29
ProtectSystem=full
30
ProtectHome=yes
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
31
CapabilityBoundingSet=CAP_KILL CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_NET_RAW
905 by Teddy Hogeborn
Add some more restrictions to the systemd service file.
32
ProtectKernelTunables=yes
33
ProtectControlGroups=yes
638 by Teddy Hogeborn
Add systemd service support for Mandos server.
34
35
[Install]
36
WantedBy=multi-user.target