contrib: add example systemd service file

contrib/init/gridcoinresearchd.service

@@ -0,0 +1,82 @@
+# It is not recommended to modify this file in-place, because it will
+# be overwritten during package upgrades. If you want to add further
+# options or overwrite existing ones then use
+# $ systemctl edit gridcoinresearchd.service
+# See "man systemd.service" for details.
+
+# Note that almost all daemon options could be specified in
+# /etc/gridcoin/gridcoin.conf, but keep in mind those explicitly
+# specified as arguments in ExecStart= will override those in the
+# config file.
+
+[Unit]
+Description=Gridcoin daemon
+Documentation=https://github.com/gridcoin-community/Gridcoin-Research/blob/development/doc/gridcoinresearch.conf.md
+
+# https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+ExecStart=/usr/bin/gridcoinresearchd -daemonwait \
+                                     -pid=/run/gridcoinresearchd/gridcoinresearchd.pid \
+                                     -conf=/etc/gridcoin/gridcoin.conf \
+                                     -datadir=/var/lib/gridcoinresearchd
+
+# Make sure the config directory is readable by the service user
+PermissionsStartOnly=true
+ExecStartPre=/bin/chgrp gridcoin /etc/gridcoin
+
+# Process management
+####################
+
+Type=forking
+PIDFile=/run/gridcoinresearchd/gridcoinresearchd.pid
+Restart=on-failure
+TimeoutStartSec=infinity
+TimeoutStopSec=600
+
+# Directory creation and permissions
+####################################
+
+# Run as gridcoin:gridcoin
+User=gridcoin
+Group=gridcoin
+
+# /run/gridcoinresearchd
+RuntimeDirectory=gridcoinresearchd
+RuntimeDirectoryMode=0710
+
+# /etc/gridcoin
+ConfigurationDirectory=gridcoin
+ConfigurationDirectoryMode=0710
+
+# /var/lib/gridcoinresearchd
+StateDirectory=gridcoinresearchd
+StateDirectoryMode=0710
+
+# Hardening measures
+####################
+
+# Provide a private /tmp and /var/tmp.
+PrivateTmp=true
+
+# Mount /usr, /boot/ and /etc read-only for the process.
+ProtectSystem=full
+
+# Deny access to /home, /root and /run/user
+ProtectHome=true
+
+# Disallow the process and all of its children to gain
+# new privileges through execve().
+NoNewPrivileges=true
+
+# Use a new /dev namespace only populated with API pseudo devices
+# such as /dev/null, /dev/zero and /dev/random.
+PrivateDevices=true
+
+# Deny the creation of writable and executable memory mappings.
+MemoryDenyWriteExecute=true
+
+[Install]
+WantedBy=multi-user.target