maxmustermann/dogecoin
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
dogecoin/contrib/init/bitcoind.service

78 lines
1.9 KiB
SYSTEMD
Raw Normal View History

Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually).
2017-06-05 10:38:42 +02:00
# It is not recommended to modify this file in-place, because it will
# be overwritten during package upgrades. If you want to add further
# options or overwrite existing ones then use
# $ systemctl edit bitcoind.service
# See "man systemd.service" for details.
# Note that almost all daemon options could be specified in
Improve clarity of systemd service file comments The phrasing seemed to indicate that the options specified in ExecStart= could not be specified in the config file, necessitating their inclusion in the service file. However, the options in the config file simply get overridden by any specified in ExecStart=.
2019-08-06 13:05:43 +02:00
# /etc/bitcoin/bitcoin.conf, but keep in mind those explicitly
# specified as arguments in ExecStart= will override those in the
# config file.
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually).
2017-06-05 10:38:42 +02:00
Added systemd .service file in order to help distributions integrate bitcoind.
2014-07-23 20:10:01 +02:00
[Unit]
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually).
2017-06-05 10:38:42 +02:00
Description=Bitcoin daemon
Added systemd .service file in order to help distributions integrate bitcoind.
2014-07-23 20:10:01 +02:00
After=network.target
[Service]
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory.
2019-01-03 14:53:51 +01:00
ExecStart=/usr/bin/bitcoind -daemon \
-pid=/run/bitcoind/bitcoind.pid \
-conf=/etc/bitcoin/bitcoin.conf \
-datadir=/var/lib/bitcoind
Chgrp config dir to bitcoin in systemd service Rather than making the config dir world-readable, which potentially leaks RPC credentials, the group of the directory is changed to the one the service is executed as.
2019-08-06 14:21:34 +02:00
# Make sure the config directory is readable by the service user
PermissionsStartOnly=true
ExecStartPre=/bin/chgrp bitcoin /etc/bitcoin
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory.
2019-01-03 14:53:51 +01:00
# Process management
####################
Added systemd .service file in order to help distributions integrate bitcoind.
2014-07-23 20:10:01 +02:00
Type=forking
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually).
2017-06-05 10:38:42 +02:00
PIDFile=/run/bitcoind/bitcoind.pid
Restart=on-failure
Set init stop timeout to 10 min `bitcoind` can take a long time to flush its db cache to disk upon shutdown. Most init files send a `SIGKILL` after a timeout of 1 minute, causing unclean shutdowns and triggering a long "Rolling forward" at the next startup. Increasing this timeout to 10 minutes should reduce how often this occurs, especially during IBD. fixup! Set ProtectHome in systemd service file
2019-08-08 11:56:45 +02:00
TimeoutStopSec=600
Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services.
2018-01-06 18:56:13 +01:00
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory.
2019-01-03 14:53:51 +01:00
# Directory creation and permissions
####################################
# Run as bitcoin:bitcoin
User=bitcoin
Group=bitcoin
# /run/bitcoind
RuntimeDirectory=bitcoind
RuntimeDirectoryMode=0710
# /etc/bitcoin
ConfigurationDirectory=bitcoin
ConfigurationDirectoryMode=0710
# /var/lib/bitcoind
StateDirectory=bitcoind
StateDirectoryMode=0710
Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services.
2018-01-06 18:56:13 +01:00
# Hardening measures
####################
# Provide a private /tmp and /var/tmp.
Added systemd .service file in order to help distributions integrate bitcoind.
2014-07-23 20:10:01 +02:00
PrivateTmp=true
Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services.
2018-01-06 18:56:13 +01:00
# Mount /usr, /boot/ and /etc read-only for the process.
ProtectSystem=full
Set ProtectHome in systemd service file Further hardening; the service should be run with as many restrictions as possible without breaking it.
2019-08-06 14:34:07 +02:00
# Deny access to /home, /root and /run/user
ProtectHome=true
Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services.
2018-01-06 18:56:13 +01:00
# Disallow the process and all of its children to gain
# new privileges through execve().
NoNewPrivileges=true
# Use a new /dev namespace only populated with API pseudo devices
# such as /dev/null, /dev/zero and /dev/random.
PrivateDevices=true
# Deny the creation of writable and executable memory mappings.
MemoryDenyWriteExecute=true
Added systemd .service file in order to help distributions integrate bitcoind.
2014-07-23 20:10:01 +02:00
[Install]
WantedBy=multi-user.target
Reference in a new issue Copy permalink