blob: f0bb3a67978b727e92f9dc4a498a89bb5adaf063 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
[Unit]
Description=SimpleX SMP relay server
Documentation=https://simplex.chat/docs/server.html
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=smp
Group=smp
# smp-server listens on ports 443 and 8443 — privileged ports require this cap.
# AmbientCapabilities is the correct Arch Linux approach for unprivileged service users.
# Do NOT run as root.
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
ExecStart=/usr/bin/smp-server start +RTS -N -RTS
# CRITICAL: smp-server saves undelivered messages only on SIGINT, not SIGTERM.
# Without this override, systemctl stop would silently lose pending messages.
KillSignal=SIGINT
TimeoutStopSec=infinity
# Backup store log on shutdown (contains messages pending delivery)
ExecStopPost=/bin/sh -c \
'test -f /var/opt/simplex/smp-server-store.log && \
cp /var/opt/simplex/smp-server-store.log \
/var/opt/simplex/smp-server-store.log.bak'
# SMP server handles many concurrent connections
LimitNOFILE=65535
# Security hardening
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/var/opt/simplex /etc/opt/simplex
ProtectHome=true
NoNewPrivileges=true
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
[Install]
WantedBy=multi-user.target
|