| 1 |
[Unit] |
| 2 |
Description=PoM Health Monitor |
| 3 |
After=network-online.target |
| 4 |
Wants=network-online.target |
| 5 |
|
| 6 |
[Service] |
| 7 |
Type=simple |
| 8 |
User=pom |
| 9 |
Group=pom |
| 10 |
EnvironmentFile=-/etc/pom/env |
| 11 |
# Kept only so an older binary rolled back under this unit still finds |
| 12 |
# /var/lib/pom/pom.db. storage.db_path in pom.toml is the authority now, and a |
| 13 |
# current binary ignores this. |
| 14 |
Environment=XDG_DATA_HOME=/var/lib |
| 15 |
ExecStart=/usr/local/bin/pom serve --config /etc/pom/pom.toml |
| 16 |
Restart=on-failure |
| 17 |
RestartSec=10 |
| 18 |
|
| 19 |
# Security hardening |
| 20 |
NoNewPrivileges=true |
| 21 |
ProtectSystem=strict |
| 22 |
ProtectHome=true |
| 23 |
PrivateTmp=true |
| 24 |
ReadOnlyPaths=/etc/pom |
| 25 |
ReadWritePaths=/var/lib/pom |
| 26 |
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 |
| 27 |
RestrictNamespaces=true |
| 28 |
RestrictSUIDSGID=true |
| 29 |
LockPersonality=true |
| 30 |
ProtectKernelTunables=true |
| 31 |
ProtectKernelModules=true |
| 32 |
ProtectControlGroups=true |
| 33 |
SystemCallArchitectures=native |
| 34 |
MemoryMax=256M |
| 35 |
|
| 36 |
[Install] |
| 37 |
WantedBy=multi-user.target |
| 38 |
|