|
|
@@ -1,57 +0,0 @@
|
|
|
-[Unit]
|
|
|
-Description=SmartBotic Database Service
|
|
|
-Documentation=https://github.com/smartbotic/smartbotic-crm
|
|
|
-After=network.target
|
|
|
-Wants=network-online.target
|
|
|
-
|
|
|
-[Service]
|
|
|
-Type=simple
|
|
|
-User=smartbotic
|
|
|
-Group=smartbotic
|
|
|
-WorkingDirectory=/opt/smartbotic
|
|
|
-
|
|
|
-# Main executable
|
|
|
-ExecStart=/opt/smartbotic/bin/smartbotic-db --config /etc/smartbotic/smartbotic-db.yaml
|
|
|
-
|
|
|
-# Graceful shutdown handling
|
|
|
-ExecStop=/bin/kill -SIGTERM $MAINPID
|
|
|
-TimeoutStopSec=30
|
|
|
-KillMode=mixed
|
|
|
-KillSignal=SIGTERM
|
|
|
-
|
|
|
-# Restart policy
|
|
|
-Restart=on-failure
|
|
|
-RestartSec=5
|
|
|
-StartLimitIntervalSec=60
|
|
|
-StartLimitBurst=3
|
|
|
-
|
|
|
-# Security hardening
|
|
|
-NoNewPrivileges=yes
|
|
|
-ProtectSystem=strict
|
|
|
-ProtectHome=yes
|
|
|
-PrivateTmp=yes
|
|
|
-PrivateDevices=yes
|
|
|
-ProtectKernelTunables=yes
|
|
|
-ProtectKernelModules=yes
|
|
|
-ProtectControlGroups=yes
|
|
|
-RestrictRealtime=yes
|
|
|
-RestrictSUIDSGID=yes
|
|
|
-LockPersonality=yes
|
|
|
-
|
|
|
-# Allow write access to data directory
|
|
|
-ReadWritePaths=/var/lib/smartbotic
|
|
|
-
|
|
|
-# Environment variables for secrets (can be overridden in drop-in files)
|
|
|
-# Create /etc/systemd/system/smartbotic-db.service.d/encryption.conf with:
|
|
|
-# [Service]
|
|
|
-# Environment="SMARTBOTIC_DB_ENCRYPTION_KEY=your-base64-key"
|
|
|
-Environment="SMARTBOTIC_DB_DATA_DIR=/var/lib/smartbotic"
|
|
|
-Environment="SMARTBOTIC_DB_LOG_LEVEL=info"
|
|
|
-
|
|
|
-# Logging
|
|
|
-StandardOutput=journal
|
|
|
-StandardError=journal
|
|
|
-SyslogIdentifier=smartbotic-db
|
|
|
-
|
|
|
-[Install]
|
|
|
-WantedBy=multi-user.target
|
