git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix(contrib): revamped systemd service example (#2655)
e00c7a7Konstantin Shalygin
contrib/oauth2-proxy.service.example+25−14
compare with master
unifiedsplit
@@ -1,22 +1,33 @@
1−# Systemd service file for oauth2-proxy daemon
2−#
3−# Date: Feb 9, 2016
4−# Author: Srdjan Grubor <sgnn7@sgnn7.org>
5−
6[Unit]
1[Unit]
7Description=oauth2-proxy daemon service
2Description=oauth2-proxy daemon service
8−After=network.target
3+After=network.target network-online.target nss-lookup.target basic.target
4+Wants=network-online.target nss-lookup.target
5+StartLimitIntervalSec=30
6+StartLimitBurst=3
9
7
10[Service]
8[Service]
11−# www-data group and user need to be created before using these lines
9+User=oauth2-proxy
12−User=www-data
10+Group=oauth2-proxy
13−Group=www-data
11+Restart=on-failure
14−
12+RestartSec=30
13+WorkingDirectory=/etc/oauth2-proxy
15−ExecStart=/usr/local/bin/oauth2-proxy --config=/etc/oauth2-proxy.cfg
14+ExecStart=/usr/bin/oauth2-proxy --config=/etc/oauth2-proxy/oauth2-proxy.cfg
16ExecReload=/bin/kill -HUP $MAINPID
15ExecReload=/bin/kill -HUP $MAINPID
17−
16+LimitNOFILE=65535
18−KillMode=process
17+NoNewPrivileges=true
19−Restart=always
18+ProtectHome=true
19+ProtectSystem=full
20+ProtectHostname=true
21+ProtectControlGroups=true
22+ProtectKernelModules=true
23+ProtectKernelTunables=true
24+LockPersonality=true
25+RestrictRealtime=yes
26+RestrictNamespaces=yes
27+MemoryDenyWriteExecute=yes
28+PrivateDevices=yes
29+PrivateTmp=true
30+CapabilityBoundingSet=
20
31
21[Install]
32[Install]
22WantedBy=multi-user.target
33WantedBy=multi-user.target