1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
# OnionBalance systemd target
[Unit]
Description=OnionBalance - Tor Onion Service load balancer
Documentation=man:onionbalance
Documentation=file:///usr/share/doc/onionbalance/html/index.html
Documentation=https://github.com/DonnchaC/onionbalance
After=network.target tor.target
Wants=network-online.target
ConditionPathExists=/etc/onionbalance/config.yaml
[Service]
Type=simple
PIDFile=/run/onionbalance.pid
Environment="ONIONBALANCE_LOG_LOCATION=/var/log/onionbalance/log"
ExecStart=/usr/sbin/onionbalance -c /etc/onionbalance/config.yaml
ExecReload=/usr/sbin/onionbalance reload
ExecStop=-/sbin/start-stop-daemon --quiet --stop --retry=TERM/5/KILL/5 --pidfile /run/onionbalance.pid
TimeoutStopSec=5
KillMode=mixed
EnvironmentFile=-/etc/default/%p
User=onionbalance
PermissionsStartOnly=true
Restart=on-abnormal
RestartSec=2s
LimitNOFILE=65536
# Hardening
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
LockPersonality=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/proc
ReadWriteDirectories=-/var/log/onionbalance
ReadWriteDirectories=-/var/run
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
[Install]
WantedBy=multi-user.target
|
