# One of several dragoman processes sharing their ports (SO_REUSEPORT): enable
# as many instances as wanted, e.g. `systemctl enable --now dragoman@{1..4}`, and
# the kernel hands each new connection to one of them. Run these or
# dragoman.service, not both: without --reuse-port that one cannot share a port.
[Unit]
Description=dragoman PID redirection and content negotiation server, process %i
Documentation=https://codeberg.org/front-matter/dragoman
After=network.target
# The databases live under /var/lib/commonmeta, which is often a separate mount.
# Without this, on boot the service can start before that filesystem is mounted,
# see an empty directory, and run degraded ("sqlite file not found" / "caching
# disabled") until manually restarted — it only checks the DB/cache at startup.
RequiresMountsFor=/var/lib/commonmeta
[Service]
Type=simple
User=dragoman
Group=dragoman
WorkingDirectory=/var/lib/commonmeta
EnvironmentFile=/etc/default/commonmeta
ExecStart=/usr/local/bin/dragoman start --reuse-port
Restart=on-failure
RestartSec=30
# Allow binding privileged ports (80, 443) as non-root
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
# Harden the service
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
# Both databases (commonmeta.sqlite3 and cache.sqlite3) live here; the cache is
# opened read-write. If you enable built-in TLS, the ACME cert cache defaults to
# /var/lib/dragoman/acme — either add it here or set DRAGOMAN_ACME_CACHE to a
# path under /var/lib/commonmeta.
ReadWritePaths=/var/lib/commonmeta
ProtectHome=true
[Install]
WantedBy=multi-user.target