This commit is contained in:
parent
079c914f8f
commit
83efaab5be
5 changed files with 183 additions and 0 deletions
47
gitea/gitea.service
Normal file
47
gitea/gitea.service
Normal file
|
@ -0,0 +1,47 @@
|
|||
[Unit]
|
||||
Description=Gitea (Git with a cup of tea)
|
||||
After=syslog.target
|
||||
After=network.target
|
||||
After=mysqld.service
|
||||
After=postgresql.service
|
||||
After=memcached.service
|
||||
After=redis.service
|
||||
|
||||
[Service]
|
||||
User=gitea
|
||||
Group=gitea
|
||||
Type=simple
|
||||
WorkingDirectory=~
|
||||
RuntimeDirectory=gitea
|
||||
LogsDirectory=gitea
|
||||
StateDirectory=gitea
|
||||
Environment=USER=gitea HOME=/var/lib/gitea GITEA_WORK_DIR=/var/lib/gitea
|
||||
ExecStart=/usr/bin/gitea web -c /etc/gitea/app.ini
|
||||
Restart=always
|
||||
RestartSec=2s
|
||||
CapabilityBoundingSet=
|
||||
NoNewPrivileges=True
|
||||
#SecureBits=noroot-locked
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ReadWritePaths=/etc/gitea/app.ini
|
||||
PrivateTmp=true
|
||||
PrivateDevices=true
|
||||
PrivateUsers=true
|
||||
ProtectHostname=true
|
||||
ProtectClock=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectKernelLogs=true
|
||||
ProtectControlGroups=true
|
||||
LockPersonality=true
|
||||
MemoryDenyWriteExecute=true
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
|
||||
RestrictRealtime=true
|
||||
RestrictSUIDSGID=true
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=@system-service
|
||||
SystemCallErrorNumber=EPERM
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
Loading…
Add table
Add a link
Reference in a new issue