akkoma/installation/pleroma.service

[Unit]
Description=Pleroma social network
After=network.target postgresql.service

[Service]
ExecReload=/bin/kill $MAINPID
KillMode=process
Restart=on-failure

; Name of the user that runs the Pleroma service.
User=pleroma
; Declares that Pleroma runs in production mode.
Environment="MIX_ENV=prod"

; Make sure that all paths fit your installation.
; Path to the home directory of the user running the Pleroma service.
Environment="HOME=/var/lib/pleroma"
; Path to the folder containing the Pleroma installation.
WorkingDirectory=/opt/pleroma
; Path to the Mix binary.
ExecStart=/usr/bin/mix phx.server

; Some security directives.
; Use private /tmp and /var/tmp folders inside a new file system namespace, which are discarded after the process stops.
PrivateTmp=true
; The /home, /root, and /run/user folders can not be accessed by this service anymore. If your Pleroma user has its home folder in one of the restricted places, or use one of these folders as its working directory, you have to set this to false.
ProtectHome=true
; Mount /usr, /boot, and /etc as read-only for processes invoked by this service.
ProtectSystem=full
; Sets up a new /dev mount for the process and only adds API pseudo devices like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled by default because it may not work on devices like the Raspberry Pi.
PrivateDevices=false
; Ensures that the service process and all its children can never gain new privileges through execve().
NoNewPrivileges=true
; Drops the sysadmin capability from the daemon.
CapabilityBoundingSet=~CAP_SYS_ADMIN

[Install]
WantedBy=multi-user.target
First attempt at installation documentation 2017-08-07 23:41:36 +00:00			`[Unit]`
			`Description=Pleroma social network`
			`After=network.target postgresql.service`

			`[Service]`
			`ExecReload=/bin/kill $MAINPID`
			`KillMode=process`
			`Restart=on-failure`

Add comments and change default path of the Mix binary. 2019-01-17 18:49:54 +00:00			`; Name of the user that runs the Pleroma service.`
			`User=pleroma`
			`; Declares that Pleroma runs in production mode.`
			`Environment="MIX_ENV=prod"`

			`; Make sure that all paths fit your installation.`
			`; Path to the home directory of the user running the Pleroma service.`
Update service files of OpenRC and systemd to new recommended paths 2019-02-10 19:25:34 +00:00			`Environment="HOME=/var/lib/pleroma"`
Add comments and change default path of the Mix binary. 2019-01-17 18:49:54 +00:00			`; Path to the folder containing the Pleroma installation.`
Update service files of OpenRC and systemd to new recommended paths 2019-02-10 19:25:34 +00:00			`WorkingDirectory=/opt/pleroma`
Add comments and change default path of the Mix binary. 2019-01-17 18:49:54 +00:00			`; Path to the Mix binary.`
			`ExecStart=/usr/bin/mix phx.server`

Add some security related directives to the systemd service example 2018-10-24 22:37:31 +00:00			`; Some security directives.`
			`; Use private /tmp and /var/tmp folders inside a new file system namespace, which are discarded after the process stops.`
			`PrivateTmp=true`
Update service files of OpenRC and systemd to new recommended paths 2019-02-10 19:25:34 +00:00			`; The /home, /root, and /run/user folders can not be accessed by this service anymore. If your Pleroma user has its home folder in one of the restricted places, or use one of these folders as its working directory, you have to set this to false.`
			`ProtectHome=true`
Add a little bit more detail in the comments. 2018-10-24 22:57:47 +00:00			`; Mount /usr, /boot, and /etc as read-only for processes invoked by this service.`
Add some security related directives to the systemd service example 2018-10-24 22:37:31 +00:00			`ProtectSystem=full`
			`; Sets up a new /dev mount for the process and only adds API pseudo devices like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled by default because it may not work on devices like the Raspberry Pi.`
			`PrivateDevices=false`
Add a little bit more detail in the comments. 2018-10-24 22:57:47 +00:00			`; Ensures that the service process and all its children can never gain new privileges through execve().`
Add some security related directives to the systemd service example 2018-10-24 22:37:31 +00:00			`NoNewPrivileges=true`
Security/Drops the sysadmin privilege from the daemon 2018-12-28 20:09:48 +00:00			`; Drops the sysadmin capability from the daemon.`
			`CapabilityBoundingSet=~CAP_SYS_ADMIN`
Add some security related directives to the systemd service example 2018-10-24 22:37:31 +00:00
First attempt at installation documentation 2017-08-07 23:41:36 +00:00			`[Install]`
			`WantedBy=multi-user.target`