Created
November 9, 2022 17:48
-
-
Save exabrial/fbda5ebceb94ae2397aac16f586e70fd to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[Unit] | |
Description=xxx ${project.artifactId} ${project.version} | |
After=network.target | |
[Service] | |
Environment=SERVER_BASEPORT=${xxx.server.baseport} JAVA_HOME=/usr/lib/jvm/${runtime-jdk} | |
EnvironmentFile=/etc/default/${project.artifactId} | |
Type=simple | |
WorkingDirectory=/opt/${project.artifactId} | |
ExecStart=/usr/bin/authbind --depth 3 /usr/lib/jvm/${runtime-jdk}/bin/java -jar /opt/${project.artifactId}/${project.artifactId}-exec.jar | |
User=${project.artifactId} | |
Group=${project.artifactId} | |
RestartSec=10 | |
Restart=always | |
StandardOutput=syslog | |
StandardError=syslog | |
SyslogIdentifier=${project.artifactId} | |
SuccessExitStatus=143 | |
# Security Hardening | |
## chroot | |
RootDirectory=/opt/chroot/${project.artifactId} | |
BindPaths=/opt/${project.artifactId} | |
BindReadOnlyPaths=/bin /sbin /lib /lib64 /usr /etc/resolv.conf /etc/hosts /etc/timezone /etc/default/${project.artifactId} | |
MountAPIVFS=true | |
PrivateDevices=true | |
PrivateTmp=true | |
## disable access to features | |
LockPersonality=yes | |
ProtectClock=true | |
ProtectControlGroups=true | |
ProtectHome=true | |
ProtectHostname=true | |
ProtectKernelLogs=true | |
ProtectKernelModules=true | |
ProtectKernelTunables=true | |
ProtectSystem=full | |
RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK | |
RestrictNamespaces=yes | |
RestrictRealtime=yes | |
RestrictSUIDSGID=yes | |
### socket binding access | |
SocketBindDeny=any | |
SocketBindAllow=ipv4:tcp:2${xxx.server.baseport} | |
SocketBindAllow=ipv4:tcp:3${xxx.server.baseport} | |
# Uncomment to allow binding to port 8000 for debugger | |
# SocketBindAllow=ipv4:tcp:8000 | |
[Install] | |
WantedBy=multi-user.target |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment