2021-12-12 15:48:02 +01:00
[Unit]
Description = GoToSocial Server
[Service]
# make sure this user and group exist and have read and write permissions in your GoToSocial folder.
# if they do not exist yet create them with "sudo useradd -r gotosocial"
# then give them permission with "chown -R gotosocial:gotosocial /gotosocial" (path to your gotosocial folder)
# you can adjust the users name according to your setup
User = gotosocial
Group = gotosocial
Type = exec
Restart = on-failure
# change if your path to the GoToSocial binary is different
ExecStart = /gotosocial/gotosocial --config-path config.yaml server start
WorkingDirectory = /gotosocial
2022-03-28 13:37:16 +02:00
StandardOutput = append:/var/log/gotosocial/gotosocial.log
StandardError = inherit
# Sandboxing options to harden security
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges = yes
PrivateTmp = yes
PrivateDevices = yes
RestrictAddressFamilies = AF_UNIX AF_INET AF_INET6
RestrictNamespaces = yes
RestrictRealtime = yes
DevicePolicy = closed
ProtectSystem = full
ProtectControlGroups = yes
ProtectKernelModules = yes
ProtectKernelTunables = yes
LockPersonality = yes
SystemCallFilter = ~@clock @debug @module @mount @obsolete @reboot @setuid @swap
# Denying access to capabilities that should not be relevant
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet = ~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet = ~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet = ~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet = ~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet = ~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet = ~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet = ~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet = ~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet = ~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
2022-05-16 10:55:21 +02:00
# You might need this if you are running as non-root on a privileged port (below 1024)
#AmbientCapabilities=CAP_NET_BIND_SERVICE
2022-03-28 13:37:16 +02:00
2021-12-12 15:48:02 +01:00
[Install]
WantedBy = default.target
# After you are done editing this file move it to "/etc/systemd/system/gotosocial.service" and enable the service with "sudo systemctl enable --now gotosocial.service"
