bundlewrap/bundles/hedgedoc/files/hedgedoc.service

52 lines
1.2 KiB
SYSTEMD
Raw Permalink Normal View History

2021-09-11 17:47:28 +00:00
[Unit]
Description=HedgeDoc - The best platform to write and share markdown.
Documentation=https://docs.hedgedoc.org/
After=network.target
# Uncomment if you use MariaDB/MySQL
# After=mysql.service
# Uncomment if you use PostgreSQL
After=postgresql.service
[Service]
Type=exec
Environment=NODE_ENV=production
Restart=always
RestartSec=2s
ExecStart=yarn start --production
2021-09-11 17:47:28 +00:00
CapabilityBoundingSet=
NoNewPrivileges=true
PrivateDevices=true
RemoveIPC=true
LockPersonality=true
ProtectControlGroups=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectClock=true
ProtectHostname=true
ProtectProc=noaccess
RestrictRealtime=true
RestrictSUIDSGID=true
RestrictNamespaces=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
SystemCallArchitectures=native
2023-09-09 20:42:53 +00:00
# FIXME
# causes problems on bookworm
# see https://github.com/hedgedoc/hedgedoc/issues/4686
# cmmented out for now ...
#SystemCallFilter=@system-service
2021-09-11 17:47:28 +00:00
# You may have to adjust these settings
User=hedgedoc
Group=hedgedoc
WorkingDirectory=/opt/hedgedoc
# Example: local storage for uploads and SQLite
ReadWritePaths=/var/opt/hedgedoc
[Install]
WantedBy=multi-user.target