|
12345678910111213141516171819202122232425262728 |
- [Unit]
- Description=Pleroma social network
- After=network.target postgresql.service
-
- [Service]
- User=pleroma
- WorkingDirectory=/home/pleroma/pleroma
- Environment="HOME=/home/pleroma"
- Environment="MIX_ENV=prod"
- ExecStart=/usr/local/bin/mix phx.server
- ExecReload=/bin/kill $MAINPID
- KillMode=process
- Restart=on-failure
-
- ; Some security directives.
- ; Use private /tmp and /var/tmp folders inside a new file system namespace, which are discarded after the process stops.
- PrivateTmp=true
- ; Mount /usr, /boot, and /etc as read-only for processes invoked by this service.
- ProtectSystem=full
- ; Sets up a new /dev mount for the process and only adds API pseudo devices like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled by default because it may not work on devices like the Raspberry Pi.
- PrivateDevices=false
- ; Ensures that the service process and all its children can never gain new privileges through execve().
- NoNewPrivileges=true
- ; Drops the sysadmin capability from the daemon.
- CapabilityBoundingSet=~CAP_SYS_ADMIN
-
- [Install]
- WantedBy=multi-user.target
|