miracle091/dnscrypt-proxy
miracle091
/
dnscrypt-proxy
mirror of https://github.com/DNSCrypt/dnscrypt-proxy.git
1
0
Fork 0
Code Issues Releases Wiki Activity
dnscrypt-proxy/systemd/dnscrypt-proxy.service

54 lines
1.6 KiB
SYSTEMD
Raw Normal View History

systemd support How does it work? I don't know. Does it work? I don't know. Would I encourage its use? No.
2018-01-24 14:44:32 +01:00
[Unit]
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
Description=DNSCrypt-proxy client
Documentation=https://github.com/jedisct1/dnscrypt-proxy/wiki
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Use systemd sockets. Disable on TCP_NODELAY fail. Then define ip address in dnscrypt-proxy.toml.
systemd support How does it work? I don't know. Does it work? I don't know. Would I encourage its use? No.
2018-01-24 14:44:32 +01:00
Requires=dnscrypt-proxy.socket
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Start service after the network is online.
## Requires a wait service such as NetworkManager or systemd-networkd.
## Verify using:
## systemctl is-enabled NetworkManager-wait-online.service systemd-networkd-wait-online.service
## Then enable:
## systemctl enable NetworkManager-wait-online.service
## Or alternatively:
## systemctl enable systemd-networkd-wait-online.service
Wait for network connectivity under systemd (#389)
2018-04-18 18:31:58 +02:00
After=network-online.target
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
Wants=network-online.target
## DNSCrypt-proxy provides and requires name resolution.
systemd support How does it work? I don't know. Does it work? I don't know. Would I encourage its use? No.
2018-01-24 14:44:32 +01:00
Before=nss-lookup.target
Update systemd service to pull nss-lookup.target in. According to systemd.special(7), nss-lookup.target is a Special Passive System Unit. This means that services depending on its functionality should order themselves after the target with an After= type dependency, but should not have a Wants= dependency for them. Therefore, nss-lookup.target should be pulled in by the providing services instead, or the consumer services will never be able to order themselves after the providing services since nss-lookup.target would not be pulled in at any point in the boot process. dnscrypt-proxy.service provides name lookup functionality, and has a Before= dependency on nss-lookup.target. However, it should have a Wants= dependency on it as well in order to indicate readiness of name lookup functionality.
2018-02-02 15:51:38 +01:00
Wants=nss-lookup.target
systemd support How does it work? I don't know. Does it work? I don't know. Would I encourage its use? No.
2018-01-24 14:44:32 +01:00
[Service]
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Set O_NONBLOCK flag for socket unit.
systemd support How does it work? I don't know. Does it work? I don't know. Would I encourage its use? No.
2018-01-24 14:44:32 +01:00
NonBlocking=true
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Execute dnscrypt-proxy with configuration file.
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
ExecStart=/usr/bin/dnscrypt-proxy --config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Make /home, /root and /run/user read only.
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
ProtectHome=yes
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Make Linux control groups read only.
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
ProtectControlGroups=yes
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Deny explicit module loading.
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
ProtectKernelModules=yes
Add optional hardening to systemd service (#259)
2018-03-24 19:06:40 +01:00
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Run dnscrypt-proxy as unprivileged user with
## temporary assigned UID/GID. See man:systemd.exec
## for more info. Requires systemd 232+.
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
DynamicUser=yes
CacheDirectory=dnscrypt-proxy
LogsDirectory=dnscrypt-proxy
RuntimeDirectory=dnscrypt-proxy
[Install]
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Install socket unit.
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
Also=dnscrypt-proxy.socket
Documentation and Wants=network-online.target (#395) Documentation and Wants=network-online.target
2018-04-20 07:00:24 +02:00
## Create symlink for systemd to pull in the unit when starting multi-user.target
## Can be found in /etc/systemd/system/multi-user.target.wants/
Adding DynamicUser to systemd service file, enhancing socket and service (#261) * Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file. Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration. * systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality. * systemd/dnscrypt-proxy.service: Updating Description to match project name. Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings. * systemd/dnscrypt-proxy.socket: Updating description to match project name. * systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities. * dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
2018-03-26 20:48:22 +02:00
WantedBy=multi-user.target