update systemd configs
This commit is contained in:
AJ ONeal
parent
eada75a83e
commit
e848e1466b
|
|
@ -0,0 +1,61 @@
|
|||
# Pre-req
|
||||
# sudo adduser telebit --home /opt/telebit
|
||||
# sudo mkdir -p /opt/telebit/
|
||||
# sudo chown -R telebit:telebit /opt/telebit/
|
||||
|
||||
[Unit]
|
||||
Description=Telebit Remote
|
||||
Documentation=https://git.coolaj86.com/coolaj86/telebit.js/
|
||||
|
||||
[Service]
|
||||
# Restart on crash (bad signal), but not on 'clean' failure (error exit code)
|
||||
# Allow up to 3 restarts within 10 seconds
|
||||
# (it's unlikely that a user or properly-running script will do this)
|
||||
Restart=always
|
||||
StartLimitInterval=10
|
||||
StartLimitBurst=3
|
||||
|
||||
# https://wiki.archlinux.org/index.php/Systemd/User
|
||||
# ~/.local/share/systemd/user/
|
||||
WorkingDirectory=%h/.config/telebit
|
||||
# custom directory cannot be set and will be the place where gitea exists, not the working directory
|
||||
ExecStart=/opt/telebit/bin/node /opt/telebit/bin/telebit.js --config /etc/telebit/telebit.yml
|
||||
ExecReload=/bin/kill -USR1 $MAINPID
|
||||
|
||||
# Limit the number of file descriptors and processes; see `man systemd.exec` for more limit settings.
|
||||
# Unmodified gitea is not expected to use more than this.
|
||||
LimitNOFILE=1048576
|
||||
LimitNPROC=64
|
||||
|
||||
# Use private /tmp and /var/tmp, which are discarded after gitea stops.
|
||||
PrivateTmp=true
|
||||
# Use a minimal /dev
|
||||
PrivateDevices=true
|
||||
# Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
|
||||
ProtectHome=true
|
||||
# Make /usr, /boot, /etc and possibly some more folders read-only.
|
||||
ProtectSystem=full
|
||||
# ... except /opt/gitea because we want a place for the database
|
||||
# and /var/log/gitea because we want a place where logs can go.
|
||||
# This merely retains r/w access rights, it does not add any new.
|
||||
# Must still be writable on the host!
|
||||
ReadWriteDirectories=/opt/telebit /etc/telebit
|
||||
|
||||
# Note: in v231 and above ReadWritePaths has been renamed to ReadWriteDirectories
|
||||
; ReadWritePaths=/opt/telebit /etc/telebit
|
||||
|
||||
# The following additional security directives only work with systemd v229 or later.
|
||||
# They further retrict privileges that can be gained by gitea.
|
||||
# Note that you may have to add capabilities required by any plugins in use.
|
||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
NoNewPrivileges=true
|
||||
|
||||
# Caveat: Some features may need additional capabilities.
|
||||
# For example an "upload" may need CAP_LEASE
|
||||
; CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_LEASE
|
||||
; AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_LEASE
|
||||
; NoNewPrivileges=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -4,7 +4,7 @@
|
|||
# sudo chown -R telebit:telebit /opt/telebit/
|
||||
|
||||
[Unit]
|
||||
Description=Telebit Relay
|
||||
Description=Telebit Remote
|
||||
Documentation=https://git.coolaj86.com/coolaj86/telebit.js/
|
||||
After=network-online.target
|
||||
Wants=network-online.target systemd-networkd-wait-online.service
|
||||
|
|
@ -13,7 +13,7 @@ Wants=network-online.target systemd-networkd-wait-online.service
|
|||
# Restart on crash (bad signal), but not on 'clean' failure (error exit code)
|
||||
# Allow up to 3 restarts within 10 seconds
|
||||
# (it's unlikely that a user or properly-running script will do this)
|
||||
Restart=on-abnormal
|
||||
Restart=always
|
||||
StartLimitInterval=10
|
||||
StartLimitBurst=3
|
||||
|
||||
|
|
@ -191,18 +191,38 @@ if [ -z "$(cat /etc/passwd | grep $my_user)" ]; then
|
|||
sudo adduser --home $TELEBIT_PATH --gecos '' --disabled-password $my_user >/dev/null 2>&1
|
||||
fi
|
||||
|
||||
if [ ! -f "/etc/$my_user/$my_app.yml" ]; then
|
||||
echo "### Creating config file from template. sudo may be required"
|
||||
#echo "sudo rsync -a examples/$my_app.yml /etc/$my_user/$my_app.yml"
|
||||
sudo bash -c "echo 'email: $my_email' >> /etc/$my_user/$my_app.yml"
|
||||
sudo bash -c "echo 'secret: $my_secret' >> /etc/$my_user/$my_app.yml"
|
||||
sudo bash -c "echo 'servernames: [ $my_servernames ]' >> /etc/$my_user/$my_app.yml"
|
||||
sudo bash -c "cat examples/$my_app.yml.tpl >> /etc/$my_user/$my_app.yml"
|
||||
my_config="$TELEBIT_PATH/etc/$my_app.yml"
|
||||
mkdir -p "$(dirname $my_config)"
|
||||
if [ ! -e "$my_config" ]; then
|
||||
#rsync -a examples/$my_app.yml "$my_config"
|
||||
echo "email: $my_email" >> "$my_config"
|
||||
echo "secret: $my_secret" >> "$my_config"
|
||||
echo "servernames:\n $my_servernames: {}" >> "$my_config"
|
||||
#echo "dynamic_ports:\n {}" >> "$my_config"
|
||||
cat examples/$my_app.yml.tpl >> "$my_config"
|
||||
fi
|
||||
|
||||
my_config="$HOME/.config/$my_user/$my_app.yml"
|
||||
mkdir -p "$(dirname $my_config)"
|
||||
if [ ! -e "$my_config" ]; then
|
||||
echo "cli: true" >> "$my_config"
|
||||
echo "email: $my_email" >> "$my_config"
|
||||
echo "secret: $my_secret" >> "$my_config"
|
||||
cat examples/$my_app.yml.tpl >> "$my_config"
|
||||
fi
|
||||
|
||||
my_config_link="/etc/$my_user/$my_app.yml"
|
||||
if [ ! -e "$my_config_link" ]; then
|
||||
echo "sudo ln -sf '$my_config' '$my_config_link'"
|
||||
#sudo mkdir -p /etc/$my_user
|
||||
sudo ln -sf "$my_config" "$my_config_link"
|
||||
fi
|
||||
|
||||
echo "sudo chown -R $my_user '$TELEBIT_PATH' '/etc/$my_user'"
|
||||
sudo chown -R $my_user "$TELEBIT_PATH" "/etc/$my_user"
|
||||
|
||||
# ~/.config/systemd/user/
|
||||
# %h/.config/telebit/telebit.yml
|
||||
echo "### Adding $my_app is a system service"
|
||||
echo "sudo rsync -a $TELEBIT_PATH/dist/etc/systemd/system/$my_app.service /etc/systemd/system/$my_app.service"
|
||||
sudo rsync -a $TELEBIT_PATH/dist/etc/systemd/system/$my_app.service /etc/systemd/system/$my_app.service
|
||||
|
|
|
|||
Loading…
Reference in New Issue