blob: f268b89b9d1f2c83ff849e1a77ee3a0f4fd9f590 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
[Unit]
Description=The unofficial Hentai@Home client written in Rust
Documentation=https://github.com/james58899/hath-rust/wiki
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
DynamicUser=yes
User=hath-rust
EnvironmentFile=-%E/hath-rust.conf
ExecStart=/usr/bin/hath-rust $HATH_EXTRA_ARGS \
--cache-dir=%C/hath-rust \
--data-dir=%d \
--log-dir=%L/hath-rust
# Credentials
LoadCredential=client_login:%E/hath-rust/client_login
# Isolation
WorkingDirectory=%S/hath-rust
ProtectProc=noaccess
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=yes
# Sandboxing
StateDirectory=hath-rust
CacheDirectory=hath-rust
LogsDirectory=hath-rust
ConfigurationDirectory=hath-rust
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
PrivateIPC=yes
PrivateUsers=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes
PrivateBPF=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
SystemCallFilter=~@mount
SystemCallFilter=~@module
SystemCallFilter=~@resources
SystemCallArchitectures=native
[Install]
WantedBy=multi-user.target
Alias=hath.service
|