summarylogtreecommitdiffstats
path: root/bitwarden_rs.service
diff options
context:
space:
mode:
authorMarkus Richter2019-01-11 13:21:51 +0100
committerMarkus Richter2019-01-11 13:21:51 +0100
commit58ccc0a166d9bf9a0e5e1e30f49541999f3a5d53 (patch)
tree7132aa194f81138b0726fcab6320fa9f449075ea /bitwarden_rs.service
parenta3e273d21eb7ac6cd7cd103ddcfb207b590765c1 (diff)
downloadaur-58ccc0a166d9bf9a0e5e1e30f49541999f3a5d53.tar.gz
1.6.0
Upstream Changelog: - Implemented new admin panel, available at /admin - To use it, you need to set the ADMIN_TOKEN variable to authenticate - Note: The old admin_email functionality has been removed - Added email invite functionality - Web vault updated to v2.8.0 - Fixed AArch64 build, disables Yubikey support - Implemented TTLs for the icon cache - Improved error handling - Bug fixes
Diffstat (limited to 'bitwarden_rs.service')
-rw-r--r--bitwarden_rs.service7
1 files changed, 7 insertions, 0 deletions
diff --git a/bitwarden_rs.service b/bitwarden_rs.service
index ff6e7a7a8061..458600a27ea6 100644
--- a/bitwarden_rs.service
+++ b/bitwarden_rs.service
@@ -4,18 +4,25 @@ Documentation=https://github.com/dani-garcia/bitwarden_rs
After=network.target
[Service]
+# The user/group bitwarden_rs is run under. the working directory (see below) should allow write and read access to this user/group
User=bitwarden_rs
Group=bitwarden_rs
+# The location of the .env file for configuration
EnvironmentFile=/etc/bitwarden_rs.env
+# The location of the compiled binary
ExecStart=/usr/bin/bitwarden_rs
+# Set reasonable connection and process limits
LimitNOFILE=1048576
LimitNPROC=64
+# Isolate bitwarden_rs from the rest of the system
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
+# Only allow writes to the following directory and set it to the working directory (user and password data are stored here)
WorkingDirectory=/var/lib/bitwarden_rs
ReadWriteDirectories=/var/lib/bitwarden_rs
+# Allow bitwarden_rs to bind ports in the range of 0-1024
AmbientCapabilities=CAP_NET_BIND_SERVICE
[Install]