blob: 43a7ba50131ea59272bf8285196073f13dbbe544 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
[Unit]
Description=Matrix-Discord hybrid puppeting/relaybot bridge
[Service]
ExecStart=mautrix-discord -c /etc/mautrix-discord/config.yaml -r /etc/mautrix-discord/registration.yaml
Restart=on-failure
User=mautrix-discord
WorkingDirectory=~
StateDirectory=mautrix-discord
ReadWritePaths=%S/mautrix-discord
# minimum-ish set of operations to allow it to work on fs, network, ipc, etc
SystemCallFilter=@system-service
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
NoNewPrivileges=True
LockPersonality=True
RestrictNamespaces=True
RemoveIPC=True
RestrictSUIDSGID=True
SystemCallArchitectures=native
MemoryDenyWriteExecute=True
PrivateTmp=True
PrivateMounts=True
ProtectSystem=strict
ProtectControlGroups=True
ProtectKernelLogs=True
ProtectKernelModules=True
ProtectKernelTunables=True
ProtectHome=True
ProtectProc=invisible
ProtectHostname=True
ProtectClock=True
RestrictRealtime=True
[Install]
WantedBy=multi-user.target
|