justme
83e5120377
Namespaces, assemblies, projects and directories, the solution, binaries, images, systemd units, config paths, environment variables, protocol method names, the media type and the raw chunk magic all move to MoShiro/moshiro. Existing data and deployments are not compatible and must be recreated. Also fix the architecture tests after the solution layout change and make the update tests independent of their order.
44 lines
1.1 KiB
Desktop File
44 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=MoShiro agent (network line quality collector)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
User=moshiro
|
|
Group=moshiro
|
|
ExecStart=/usr/lib/moshiro/moshiro-agent --config /etc/moshiro/agent.json
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# The agent is a pure collector: it reads its config and identity, never writes files, never starts processes.
|
|
ReadOnlyPaths=/etc/moshiro
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
LockPersonality=yes
|
|
# NativeAOT does not JIT, so writable+executable memory is never needed.
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
# CAP_NET_RAW only for ICMP target tasks. Ports below 1024 need CAP_NET_BIND_SERVICE (add it in a drop-in).
|
|
CapabilityBoundingSet=CAP_NET_RAW
|
|
AmbientCapabilities=CAP_NET_RAW
|
|
|
|
MemoryMax=128M
|
|
TasksMax=64
|
|
LimitNOFILE=4096
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|