| 1 |
[Unit] |
| 2 |
Description=MNW CLI SSH Server |
| 3 |
Documentation=https://makenot.work/docs |
| 4 |
After=network.target makenotwork.service |
| 5 |
Wants=network-online.target |
| 6 |
|
| 7 |
[Service] |
| 8 |
Type=simple |
| 9 |
User=mnw-cli |
| 10 |
Group=mnw-cli |
| 11 |
WorkingDirectory=/opt/mnw-cli |
| 12 |
# /usr/local/bin, not /opt/mnw-cli, since 2026-08-23. The binary is delivered by |
| 13 |
# Bento now, and install-service.sh refuses any dst outside /usr/local/bin -- |
| 14 |
# that guard is the only thing bounding a NOPASSWD sudo grant, so the binary |
| 15 |
# moves rather than the guard widening. Same call wam made on 2026-08-15. |
| 16 |
# |
| 17 |
# WorkingDirectory stays /opt/mnw-cli deliberately: that is this service's state |
| 18 |
# directory (.env, HOME, ReadWritePaths), not where the binary lives. |
| 19 |
ExecStart=/usr/local/bin/mnw-cli |
| 20 |
Restart=always |
| 21 |
RestartSec=5 |
| 22 |
|
| 23 |
# Environment |
| 24 |
EnvironmentFile=/opt/mnw-cli/.env |
| 25 |
Environment=HOME=/opt/mnw-cli |
| 26 |
|
| 27 |
# Security hardening |
| 28 |
# NoNewPrivileges and RestrictSUIDSGID must be false because mnw-cli |
| 29 |
# spawns git operations via sudo -u git (requires setuid escalation). |
| 30 |
NoNewPrivileges=false |
| 31 |
ProtectSystem=strict |
| 32 |
ProtectHome=true |
| 33 |
PrivateTmp=true |
| 34 |
ReadWritePaths=/opt/mnw-cli /var/lib/mnw-cli /var/lib/mnw |
| 35 |
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 |
| 36 |
RestrictNamespaces=true |
| 37 |
RestrictRealtime=true |
| 38 |
RestrictSUIDSGID=false |
| 39 |
LockPersonality=true |
| 40 |
ProtectKernelTunables=true |
| 41 |
ProtectKernelModules=true |
| 42 |
ProtectControlGroups=true |
| 43 |
SystemCallArchitectures=native |
| 44 |
|
| 45 |
# Resource limits |
| 46 |
LimitNOFILE=4096 |
| 47 |
MemoryMax=512M |
| 48 |
TasksMax=512 |
| 49 |
|
| 50 |
# Logging |
| 51 |
StandardOutput=journal |
| 52 |
StandardError=journal |
| 53 |
SyslogIdentifier=mnw-cli |
| 54 |
|
| 55 |
[Install] |
| 56 |
WantedBy=multi-user.target |
| 57 |
|