diff options
| author | Jason McCormick <jason@mfamily.org> | 2026-10-16 16:57:47 -0400 |
|---|---|---|
| committer | Jason McCormick <jason@mfamily.org> | 2026-10-16 16:57:47 -0400 |
| commit | 98119d8fb55e1633d7bdd79db30fd5caea9ee641 (patch) | |
| tree | 370d5aefedfc3eba4d69a6682f7d6139701a2539 /deploy/blind-uploader.service | |
Diffstat (limited to 'deploy/blind-uploader.service')
| -rw-r--r-- | deploy/blind-uploader.service | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/deploy/blind-uploader.service b/deploy/blind-uploader.service new file mode 100644 index 0000000..aa5bc5d --- /dev/null +++ b/deploy/blind-uploader.service @@ -0,0 +1,45 @@ +[Unit] +Description=Private Drop anonymous image uploader +Documentation=file:/opt/blind-uploader/README.md +After=network.target + +[Service] +Type=simple +DynamicUser=yes +WorkingDirectory=/opt/blind-uploader +ExecStart=/usr/bin/python3 /opt/blind-uploader/server.py +Restart=on-failure +RestartSec=3s + +# These defaults can be overridden using Debian's standard environment file. +Environment=HOST=127.0.0.1 +Environment=PORT=8000 +Environment=UPLOAD_DIR=/var/lib/blind-uploader/uploads +Environment=PYTHONDONTWRITEBYTECODE=1 +EnvironmentFile=-/etc/default/blind-uploader + +# systemd creates a persistent, service-owned /var/lib/blind-uploader directory. +StateDirectory=blind-uploader +StateDirectoryMode=0700 +UMask=0077 + +# Service hardening. The application only needs its state directory and TCP/IP. +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=strict +ProtectHome=yes +ProtectClock=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectKernelLogs=yes +ProtectControlGroups=yes +RestrictSUIDSGID=yes +RestrictRealtime=yes +LockPersonality=yes +CapabilityBoundingSet= +AmbientCapabilities= +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 + +[Install] +WantedBy=multi-user.target |