@@ -1,22 +1,33 @@
1−# Systemd service file for oauth2-proxy daemon
2−#
3−# Date: Feb 9, 2016
4−# Author: Srdjan Grubor <sgnn7@sgnn7.org>
5−
61[Unit]
72Description=oauth2-proxy daemon service
8−After=network.target
3+After=network.target network-online.target nss-lookup.target basic.target
4+Wants=network-online.target nss-lookup.target
5+StartLimitIntervalSec=30
6+StartLimitBurst=3
97
108[Service]
11−# www-data group and user need to be created before using these lines
12−User=www-data
13−Group=www-data
14−
15−ExecStart=/usr/local/bin/oauth2-proxy --config=/etc/oauth2-proxy.cfg
9+User=oauth2-proxy
10+Group=oauth2-proxy
11+Restart=on-failure
12+RestartSec=30
13+WorkingDirectory=/etc/oauth2-proxy
14+ExecStart=/usr/bin/oauth2-proxy --config=/etc/oauth2-proxy/oauth2-proxy.cfg
1615ExecReload=/bin/kill -HUP $MAINPID
17−
18−KillMode=process
19−Restart=always
16+LimitNOFILE=65535
17+NoNewPrivileges=true
18+ProtectHome=true
19+ProtectSystem=full
20+ProtectHostname=true
21+ProtectControlGroups=true
22+ProtectKernelModules=true
23+ProtectKernelTunables=true
24+LockPersonality=true
25+RestrictRealtime=yes
26+RestrictNamespaces=yes
27+MemoryDenyWriteExecute=yes
28+PrivateDevices=yes
29+PrivateTmp=true
30+CapabilityBoundingSet=
2031
2132[Install]
2233WantedBy=multi-user.target