blob: 9bb360eb6ea3f7ea48eb0075bd9cd9c61a314cb1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
[Unit]
Description=Trilium server daemon
After=syslog.target network.target
[Service]
User=triliumserver
Group=triliumserver
Type=simple
Environment=TRILIUM_DATA_DIR=/var/lib/trilium-server
Environment=TRILIUM_CONFIG_INI_PATH=/etc/trilium-server.conf
Environment=TRILIUM_LOG_DIR=/var/log/trilium-server
ExecStart=/usr/bin/trilium-server
WorkingDirectory=/var/lib/trilium-server
# Sandboxing
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/var/lib/trilium-server /var/log/trilium-server
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
PrivateIPC=yes
PrivateUsers=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
LockPersonality=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
NoNewPrivileges=yes
SystemCallArchitectures=native
TimeoutStopSec=20
# KillMode=process leads to error, according to https://www.freedesktop.org/software/systemd/man/systemd.kill.html
Restart=always
[Install]
WantedBy=multi-user.target
|