| 1 | [Unit] |
| 2 | Description=Ferrenium git repository browser |
| 3 | After=network.target |
| 4 | |
| 5 | [Service] |
| 6 | Type=notify |
| 7 | ExecStart=/usr/local/bin/ferrenium serve --config /etc/ferrenium/ferrenium.toml |
| 8 | ExecReload=/bin/kill -HUP $MAINPID |
| 9 | Restart=on-failure |
| 10 | TimeoutStopSec=15 |
| 11 | |
| 12 | User=git |
| 13 | Group=git |
| 14 | RuntimeDirectory=ferrenium |
| 15 | RuntimeDirectoryMode=0755 |
| 16 | |
| 17 | # Read-only sandbox: ferrenium never writes to disk. Check the result with |
| 18 | # `systemd-analyze security ferrenium.service`. |
| 19 | ProtectSystem=strict |
| 20 | # The repositories live in /home/git. With a scan_path outside /home, use |
| 21 | # ProtectHome=yes instead. |
| 22 | ProtectHome=read-only |
| 23 | PrivateTmp=yes |
| 24 | PrivateDevices=yes |
| 25 | DevicePolicy=closed |
| 26 | ProtectKernelTunables=yes |
| 27 | ProtectKernelModules=yes |
| 28 | ProtectKernelLogs=yes |
| 29 | ProtectControlGroups=yes |
| 30 | ProtectClock=yes |
| 31 | ProtectHostname=yes |
| 32 | ProtectProc=invisible |
| 33 | ProcSubset=pid |
| 34 | NoNewPrivileges=yes |
| 35 | CapabilityBoundingSet= |
| 36 | AmbientCapabilities= |
| 37 | RestrictNamespaces=yes |
| 38 | RestrictRealtime=yes |
| 39 | RestrictSUIDSGID=yes |
| 40 | LockPersonality=yes |
| 41 | MemoryDenyWriteExecute=yes |
| 42 | SystemCallArchitectures=native |
| 43 | SystemCallFilter=@system-service |
| 44 | SystemCallFilter=~@privileged @resources |
| 45 | SystemCallErrorNumber=EPERM |
| 46 | RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 |
| 47 | # Only the reverse proxy on this host talks to ferrenium, and ferrenium |
| 48 | # opens no outbound connections. Widen this if Caddy runs elsewhere. |
| 49 | IPAddressDeny=any |
| 50 | IPAddressAllow=localhost |
| 51 | RemoveIPC=yes |
| 52 | UMask=0077 |
| 53 | |
| 54 | [Install] |
| 55 | WantedBy=multi-user.target |