PKGBUILDs/extra/gitea/gitea.service

52 lines
1.1 KiB
SYSTEMD
Raw Normal View History

2019-08-03 00:34:22 +00:00
[Unit]
Description=Gitea (Git with a cup of tea)
After=syslog.target
After=network.target
After=mysqld.service
After=postgresql.service
After=memcached.service
After=redis.service
[Service]
User=gitea
Group=gitea
Type=simple
WorkingDirectory=~
RuntimeDirectory=gitea
LogsDirectory=gitea
StateDirectory=gitea
Environment=USER=gitea HOME=/var/lib/gitea GITEA_WORK_DIR=/var/lib/gitea
ExecStart=/usr/bin/gitea web -c /etc/gitea/app.ini
Restart=always
RestartSec=2s
2021-10-12 00:35:11 +00:00
ReadWritePaths=/etc/gitea/app.ini
AmbientCapabilities=
2019-08-03 00:34:22 +00:00
CapabilityBoundingSet=
2021-10-12 00:35:11 +00:00
LockPersonality=true
#Required by commit search
#MemoryDenyWriteExecute=true
2019-08-03 00:34:22 +00:00
NoNewPrivileges=True
2020-07-30 01:18:24 +00:00
#SecureBits=noroot-locked
PrivateDevices=true
2021-10-12 00:35:11 +00:00
PrivateTmp=true
2020-07-30 01:18:24 +00:00
PrivateUsers=true
ProtectClock=true
ProtectControlGroups=true
2021-10-12 00:35:11 +00:00
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
2021-03-07 23:20:00 +00:00
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
2021-10-12 00:35:11 +00:00
RestrictNamespaces=true
2019-08-03 00:34:22 +00:00
RestrictRealtime=true
2020-07-30 01:18:24 +00:00
RestrictSUIDSGID=true
2019-08-03 00:34:22 +00:00
SystemCallArchitectures=native
SystemCallFilter=@system-service
2020-09-13 18:18:45 +00:00
SystemCallErrorNumber=EPERM
2019-08-03 00:34:22 +00:00
[Install]
WantedBy=multi-user.target