drawbridge/drawbridge.service at master · CoreInfraAI/drawbridge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
[Unit]
Description=Drawbridge (WebAuthn reverse proxy)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/drawbridge -config /etc/drawbridge/drawbridge.json
WorkingDirectory=/etc/drawbridge
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure

User=drawbridge
Group=drawbridge
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=yes
LimitNOFILE=65536

MemoryDenyWriteExecute=yes
ProtectSystem=strict
PrivateDevices=yes
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service

# Autocert (ACME) uses os.UserCacheDir(); on Linux this follows $XDG_CACHE_HOME.
Environment=XDG_CACHE_HOME=/var/cache/drawbridge
CacheDirectory=drawbridge
CacheDirectoryMode=0700
UMask=0077

[Install]
WantedBy=multi-user.target