blob: 2fdbc4617ccacb7fbd790fd4a9785a92a909a357 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
[Unit]
Description=Trilium Notes server daemon
After=syslog.target network.target
[Service]
User=triliumserver
Group=triliumserver
Type=simple
Environment=TRILIUM_DATA_DIR=trilium-data/
ExecStart=./trilium.sh
WorkingDirectory=/opt/trilium-server
# Security
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/var/lib/trilium-server
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
PrivateIPC=yes
PrivateUsers=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
LockPersonality=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
NoNewPrivileges=yes
SystemCallArchitectures=native
TimeoutStopSec=20
# KillMode=process leads to error, according to https://www.freedesktop.org/software/systemd/man/systemd.kill.html
Restart=always
[Install]
WantedBy=multi-user.target
|