1 # Installed by deploy/setup.sh to /etc/systemd/system/hito.service. 2 # Edit this file, not the installed copy: install and deploy overwrite it. 3 4 [Unit] 5 Description=hito — High Intensity Trainer Online 6 After=network.target 7 8 [Service] 9 Type=simple 10 User=hito 11 Group=hito 12 WorkingDirectory=/srv/hito/current 13 ExecStart=/srv/hito/current/_build/default/bin/main.exe 14 Restart=on-failure 15 RestartSec=5 16 17 # EnvironmentFile= values override Environment= values, whatever the order. 18 Environment=HITO_DB=sqlite3:/srv/hito/data/hito.sqlite 19 Environment=HITO_PORT=8080 20 # HITO_VERSION, rewritten by every deploy. 21 EnvironmentFile=/srv/hito/shared/deploy.env 22 # Host secrets (HITO_SECRET and so on). Keep it root:root 0600. 23 EnvironmentFile=/etc/hito/hito.env 24 25 # Hardening. Only the database directory is writable. 26 UMask=0077 27 NoNewPrivileges=yes 28 ProtectSystem=strict 29 ProtectHome=yes 30 ReadWritePaths=/srv/hito/data 31 InaccessiblePaths=/srv/git 32 PrivateTmp=yes 33 PrivateDevices=yes 34 CapabilityBoundingSet= 35 AmbientCapabilities= 36 ProtectKernelTunables=yes 37 ProtectKernelModules=yes 38 ProtectKernelLogs=yes 39 ProtectControlGroups=yes 40 ProtectClock=yes 41 ProtectHostname=yes 42 RestrictSUIDSGID=yes 43 RestrictNamespaces=yes 44 RestrictRealtime=yes 45 RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX 46 LockPersonality=yes 47 MemoryDenyWriteExecute=yes 48 SystemCallArchitectures=native 49 SystemCallFilter=@system-service 50 51 [Install] 52 WantedBy=multi-user.target 53