mirror of
https://github.com/DNSCrypt/dnscrypt-proxy.git
synced 2024-12-13 22:46:44 +01:00
fa2c95084e
* Adding nss-lookup.target to the socket Before and Wants directive. Adding current upstream wiki as documentation to service and socket file.
Adding DynamicUser=yes to the service file, alongside various hardening settings (Protect{ControlGroups,KernelModules}. Allowing the service to bind to ports below 1024 by setting CAP_NET_BIND_SERVICE. Adding {Cache,Logs,Runtime}Directory for dnscrypt-proxy. Removing (default) Type=simple. Adding a more default ExecStart location and usage of configuration.
* systemd/dnscrypt-proxy.socket: Adding back ipv6 functionality.
* systemd/dnscrypt-proxy.service: Updating Description to match project name.
Explicitely setting ProtectHome=yes. Adding information on the DynamicUser settings.
* systemd/dnscrypt-proxy.socket: Updating description to match project name.
* systemd/dnscrypt-proxy.service: Adding Requires= and Also= for dnscrypt-proxy.socket in favor of CAP_NET_BIND_SERVICE capabilities.
* dnscrypt-proxy/example-dnscrypt-proxy.toml: Clarifying how to set listen_addresses, when using systemd socket activation.
27 lines
692 B
Desktop File
27 lines
692 B
Desktop File
[Unit]
|
|
Description=DNSCrypt-proxy client
|
|
Documentation=https://github.com/jedisct1/dnscrypt-proxy/wiki
|
|
Requires=dnscrypt-proxy.socket
|
|
After=network.target
|
|
Before=nss-lookup.target
|
|
Wants=nss-lookup.target
|
|
|
|
[Service]
|
|
NonBlocking=true
|
|
ExecStart=/usr/bin/dnscrypt-proxy --config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
|
|
ProtectHome=yes
|
|
ProtectControlGroups=yes
|
|
ProtectKernelModules=yes
|
|
|
|
# Run dnscrypt-proxy as unprivileged user with
|
|
# temporary assigned UID/GID. See man:systemd.exec
|
|
# for more info. Requires systemd 232+.
|
|
DynamicUser=yes
|
|
CacheDirectory=dnscrypt-proxy
|
|
LogsDirectory=dnscrypt-proxy
|
|
RuntimeDirectory=dnscrypt-proxy
|
|
|
|
[Install]
|
|
Also=dnscrypt-proxy.socket
|
|
WantedBy=multi-user.target
|