justme
83e5120377
Namespaces, assemblies, projects and directories, the solution, binaries, images, systemd units, config paths, environment variables, protocol method names, the media type and the raw chunk magic all move to MoShiro/moshiro. Existing data and deployments are not compatible and must be recreated. Also fix the architecture tests after the solution layout change and make the update tests independent of their order.
44 lines
1.1 KiB
Desktop File
44 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=MoShiro probe (network line quality measurement origin)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
User=moshiro
|
|
Group=moshiro
|
|
ExecStart=/usr/lib/moshiro/moshiro-probe --config /etc/moshiro/probe.json
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# The probe is a pure collector: it never starts processes and writes no measurement data.
|
|
# The only file the probe writes is agents.json (the latest agent list) next to probe.json.
|
|
ReadWritePaths=/etc/moshiro
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
LockPersonality=yes
|
|
# NativeAOT does not JIT, so writable+executable memory is never needed.
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
# No capabilities needed: the probe only dials out.
|
|
CapabilityBoundingSet=
|
|
|
|
MemoryMax=64M
|
|
TasksMax=64
|
|
LimitNOFILE=4096
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|