Dustin C. Hatch
66e8246c3b
I think it makes the most sense to install the systemd unit files for services along with their binaries. This is how most software provided by Linux distribution package manager works. Providing the systemd unit with the package eliminates the need for variability, since the paths to the executable and other files are well defined.
52 lines
1.1 KiB
Desktop File
52 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Victoria Metrics vmalert
|
|
Documentation=https://docs.victoriametrics.com/vmalert.html
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
Environment=httpListenAddr=[::1]:8880
|
|
Environment=loggerDisableTimestamps=true
|
|
EnvironmentFile=-/etc/sysconfig/vmalert
|
|
ExecStart=/usr/bin/vmagent -enableTCP6 -envflag.enable
|
|
Restart=on-failure
|
|
User=victoriametrics
|
|
Group=victoriametrics
|
|
LimitNOFILE=1048576
|
|
|
|
CapabilityBoundingSet=
|
|
DeviceAllow=
|
|
DevicePolicy=closed
|
|
DynamicUser=yes
|
|
IPAddressAllow=localhost
|
|
IPAddressDeny=any
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateUsers=yes
|
|
PrivateTmp=yes
|
|
ProcSubset=pid
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources
|
|
UMask=0027
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|