Dustin C. Hatch
0037a3c281
MinIO is supposed to automatically reload itself when the certificate changes, but this does not appear to happen in all cases. To ensure the updated certificate gets used, we need to send SIGHUP to the MinIO server process.
36 lines
765 B
Django/Jinja
36 lines
765 B
Django/Jinja
[Unit]
|
|
Description=MinIO Object Storage
|
|
Wants=network.target
|
|
After=network.target
|
|
|
|
[Container]
|
|
Image={{ minio_container_image }}:{{ minio_version }}
|
|
Exec=server /data --certs-dir /certs
|
|
User=224
|
|
Group=224
|
|
EnvironmentFile=/etc/sysconfig/minio
|
|
Volume={{ minio_storage_path }}:/data:rw,Z
|
|
Volume=/etc/minio/certs:/certs:ro,z
|
|
Network=host
|
|
NoNewPrivileges=yes
|
|
|
|
[Service]
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
MemoryDenyWriteExecute=yes
|
|
PrivateTmp=yes
|
|
ProtectClock=yes
|
|
ProtectHome=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/containers/storage
|
|
ReadWritePaths={{ minio_storage_path }}
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|