miracle091/dnscrypt-proxy
miracle091
/
dnscrypt-proxy
mirror of https://github.com/DNSCrypt/dnscrypt-proxy.git
1
0
Fork 0
Code Issues Releases Wiki Activity
dnscrypt-proxy/systemd/dnscrypt-proxy.service

27 lines
692 B
SYSTEMD
Raw Normal View History

systemd support How does it work? I don't know. Does it work? I don't know. Would I encourage its use? No.
2018-01-24 14:44:32 +01:00
[Unit]
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
Description=DNSCrypt-proxy client
Documentation=https://github.com/jedisct1/dnscrypt-proxy/wiki
systemd support How does it work? I don't know. Does it work? I don't know. Would I encourage its use? No.
2018-01-24 14:44:32 +01:00
Requires=dnscrypt-proxy.socket
After=network.target
Before=nss-lookup.target
Update systemd service to pull nss-lookup.target in. According to systemd.special(7), nss-lookup.target is a Special Passive System Unit. This means that services depending on its functionality should order themselves after the target with an After= type dependency, but should not have a Wants= dependency for them. Therefore, nss-lookup.target should be pulled in by the providing services instead, or the consumer services will never be able to order themselves after the providing services since nss-lookup.target would not be pulled in at any point in the boot process. dnscrypt-proxy.service provides name lookup functionality, and has a Before= dependency on nss-lookup.target. However, it should have a Wants= dependency on it as well in order to indicate readiness of name lookup functionality.
2018-02-02 15:51:38 +01:00
Wants=nss-lookup.target
systemd support How does it work? I don't know. Does it work? I don't know. Would I encourage its use? No.
2018-01-24 14:44:32 +01:00
[Service]
NonBlocking=true
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
ExecStart=/usr/bin/dnscrypt-proxy --config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
ProtectHome=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
Add optional hardening to systemd service (#259)
2018-03-24 19:06:40 +01:00
# Run dnscrypt-proxy as unprivileged user with
# temporary assigned UID/GID. See man:systemd.exec
# for more info. Requires systemd 232+.
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
DynamicUser=yes
CacheDirectory=dnscrypt-proxy
LogsDirectory=dnscrypt-proxy
RuntimeDirectory=dnscrypt-proxy
[Install]
Also=dnscrypt-proxy.socket
WantedBy=multi-user.target