44 lines
1.2 KiB
Django/Jinja
44 lines
1.2 KiB
Django/Jinja
[Service]
|
|
ExecStart=
|
|
ExecStart=/usr/bin/caddy run --config {{ caddy_config_file }} --resume
|
|
|
|
ExecReload=
|
|
ExecReload=/usr/bin/caddy reload --config {{ caddy_config_file }} --force
|
|
|
|
# Wait for API to be ready before considering service started
|
|
ExecStartPost=/bin/bash -c 'until curl -s http://{{ caddy_admin_listen }}/config/ >/dev/null 2>&1; do sleep 1; done'
|
|
|
|
{% if caddy_systemd_security | default(true) %}
|
|
# Enhanced security hardening beyond base service
|
|
NoNewPrivileges=true
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
RemoveIPC=true
|
|
|
|
# Filesystem restrictions (upgrade from ProtectSystem=full)
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadWritePaths={{ caddy_data_dir }} {{ caddy_log_dir }}
|
|
BindReadOnlyPaths={{ caddy_config_dir }}
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectClock=true
|
|
|
|
# Network and namespace restrictions
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
|
|
# Process restrictions
|
|
LimitNPROC=1048576
|
|
MemoryDenyWriteExecute=true
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
# Logging (explicit configuration)
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=caddy
|
|
{% endif %}
|