2021-06-15 23:59:41 +02:00
|
|
|
# You should not need to edit this file. Instead, use a drop-in file as described in:
|
|
|
|
|
# /usr/lib/systemd/system/kanidmd.service.d/custom.conf
|
|
|
|
|
|
|
|
|
|
[Unit]
|
|
|
|
|
Description=Kanidm Identity Server
|
2023-07-25 04:23:47 +02:00
|
|
|
After=time-sync.target network-online.target
|
|
|
|
|
Wants=time-sync.target network-online.target
|
2021-06-15 23:59:41 +02:00
|
|
|
Before=radiusd.service
|
|
|
|
|
|
|
|
|
|
[Service]
|
2024-10-26 03:24:58 +02:00
|
|
|
Type=notify-reload
|
2021-06-15 23:59:41 +02:00
|
|
|
DynamicUser=yes
|
2021-07-22 04:04:48 +02:00
|
|
|
StateDirectory=kanidm
|
2023-07-25 04:23:47 +02:00
|
|
|
StateDirectoryMode=0750
|
|
|
|
|
CacheDirectory=kanidmd
|
|
|
|
|
CacheDirectoryMode=0750
|
|
|
|
|
RuntimeDirectory=kanidmd
|
|
|
|
|
RuntimeDirectoryMode=0755
|
2021-06-15 23:59:41 +02:00
|
|
|
ExecStart=/usr/sbin/kanidmd server -c /etc/kanidm/server.toml
|
|
|
|
|
|
2023-07-25 04:23:47 +02:00
|
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
|
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
|
|
|
|
2024-02-17 01:11:32 +01:00
|
|
|
# If OOM occurs, request a clean stop
|
|
|
|
|
OOMPolicy=stop
|
|
|
|
|
# Adjust our weight toward *not* being killed under pressure.
|
|
|
|
|
OOMScoreAdjust=-100
|
|
|
|
|
|
2021-06-15 23:59:41 +02:00
|
|
|
NoNewPrivileges=true
|
|
|
|
|
PrivateTmp=true
|
|
|
|
|
PrivateDevices=true
|
|
|
|
|
ProtectHostname=true
|
|
|
|
|
ProtectClock=true
|
|
|
|
|
ProtectKernelTunables=true
|
|
|
|
|
ProtectKernelModules=true
|
|
|
|
|
ProtectKernelLogs=true
|
|
|
|
|
ProtectControlGroups=true
|
|
|
|
|
MemoryDenyWriteExecute=true
|
|
|
|
|
|
|
|
|
|
[Install]
|
|
|
|
|
WantedBy=multi-user.target
|
