diff options
Diffstat (limited to 'deploy/gps-clock-dash.service')
| -rw-r--r-- | deploy/gps-clock-dash.service | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/deploy/gps-clock-dash.service b/deploy/gps-clock-dash.service new file mode 100644 index 0000000..0159595 --- /dev/null +++ b/deploy/gps-clock-dash.service @@ -0,0 +1,38 @@ +[Unit] +Description=GPS + PPS chrony time server dashboard +After=network.target chrony.service gpsd.socket +Wants=gpsd.socket + +[Service] +ExecStart=/usr/local/bin/gps-clock-dash -listen :8473 +# Once nginx fronts this, bind to loopback only: +# ExecStart=/usr/local/bin/gps-clock-dash -listen 127.0.0.1:8473 +Restart=on-failure +RestartSec=5 + +# Unprivileged, sandboxed. chronyc's monitoring commands (tracking, sources, +# sourcestats) work over chronyd's localhost UDP port without privileges. +DynamicUser=yes +NoNewPrivileges=yes +ProtectSystem=strict +ProtectHome=yes +PrivateTmp=yes +PrivateDevices=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=yes +LockPersonality=yes +MemoryDenyWriteExecute=yes +SystemCallArchitectures=native + +# Optional: to show the "NTP requests" (serverstats) row, chronyc needs +# chronyd's privileged socket in /run/chrony, which is owned by _chrony. +# Uncomment both lines below. Note this lets the process issue any chronyc +# command, including ones that change chronyd's behaviour. +#DynamicUser=no +#User=_chrony + +[Install] +WantedBy=multi-user.target |