diff --git a/contrib/init/gridcoinresearchd.service b/contrib/init/gridcoinresearchd.service new file mode 100644 index 0000000000..5077f85301 --- /dev/null +++ b/contrib/init/gridcoinresearchd.service @@ -0,0 +1,82 @@ +# It is not recommended to modify this file in-place, because it will +# be overwritten during package upgrades. If you want to add further +# options or overwrite existing ones then use +# $ systemctl edit gridcoinresearchd.service +# See "man systemd.service" for details. + +# Note that almost all daemon options could be specified in +# /etc/gridcoin/gridcoin.conf, but keep in mind those explicitly +# specified as arguments in ExecStart= will override those in the +# config file. + +[Unit] +Description=Gridcoin daemon +Documentation=https://github.com/gridcoin-community/Gridcoin-Research/blob/development/doc/gridcoinresearch.conf.md + +# https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/ +After=network-online.target +Wants=network-online.target + +[Service] +ExecStart=/usr/bin/gridcoinresearchd -daemonwait \ + -pid=/run/gridcoinresearchd/gridcoinresearchd.pid \ + -conf=/etc/gridcoin/gridcoin.conf \ + -datadir=/var/lib/gridcoinresearchd + +# Make sure the config directory is readable by the service user +PermissionsStartOnly=true +ExecStartPre=/bin/chgrp gridcoin /etc/gridcoin + +# Process management +#################### + +Type=forking +PIDFile=/run/gridcoinresearchd/gridcoinresearchd.pid +Restart=on-failure +TimeoutStartSec=infinity +TimeoutStopSec=600 + +# Directory creation and permissions +#################################### + +# Run as gridcoin:gridcoin +User=gridcoin +Group=gridcoin + +# /run/gridcoinresearchd +RuntimeDirectory=gridcoinresearchd +RuntimeDirectoryMode=0710 + +# /etc/gridcoin +ConfigurationDirectory=gridcoin +ConfigurationDirectoryMode=0710 + +# /var/lib/gridcoinresearchd +StateDirectory=gridcoinresearchd +StateDirectoryMode=0710 + +# Hardening measures +#################### + +# Provide a private /tmp and /var/tmp. +PrivateTmp=true + +# Mount /usr, /boot/ and /etc read-only for the process. +ProtectSystem=full + +# Deny access to /home, /root and /run/user +ProtectHome=true + +# Disallow the process and all of its children to gain +# new privileges through execve(). +NoNewPrivileges=true + +# Use a new /dev namespace only populated with API pseudo devices +# such as /dev/null, /dev/zero and /dev/random. +PrivateDevices=true + +# Deny the creation of writable and executable memory mappings. +MemoryDenyWriteExecute=true + +[Install] +WantedBy=multi-user.target