# systemd unit for SightingDB.
#
# sudo install -m 0644 etc/sightingdb.service /etc/systemd/system/
# sudo systemctl daemon-reload
# sudo systemctl enable --now sightingdb
#
# Keep `daemonize = false` in sightingdb.conf: systemd does the backgrounding,
# and Type=exec wants the process to stay in the foreground. Point log4rs at a
# console appender and the logs land in the journal (`journalctl -u sightingdb`).
[Unit]
Description=SightingDB — a database for sightings of indicators
Documentation=https://github.com/stricaud/sightingdb
After=network-online.target
Wants=network-online.target
[Service]
Type=exec
ExecStart=/usr/local/bin/sightingdb -c /etc/sightingdb/sightingdb.conf -l /etc/sightingdb/log4rs.yml
Restart=on-failure
RestartSec=5s
User=sightingdb
Group=sightingdb
# Creates and owns /var/lib/sightingdb; set dbdir to match.
StateDirectory=sightingdb
StateDirectoryMode=0750
# Give the database time to write its final snapshot before being killed.
KillSignal=SIGTERM
TimeoutStopSec=60s
# Hardening. Relax these if a change needs wider access rather than leaving
# them off wholesale.
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
# Only needed if the daemon binds a port below 1024.
# AmbientCapabilities=CAP_NET_BIND_SERVICE
# CapabilityBoundingSet=CAP_NET_BIND_SERVICE
[Install]
WantedBy=multi-user.target