dotya.ml/ drone-ci-configs
2
0
Fork 0
Code Issues Pull Requests Releases Activity
drone-ci-configs/etc/systemd/system/drone.service

45 lines
971 B
SYSTEMD
Raw Normal View History

manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override
2022-03-20 20:54:52 +01:00
# /etc/systemd/system/drone.service
feat: added Unit file for drone
2020-05-29 12:58:04 +02:00
[Unit]
Description=Drone server
After=docker.service nginx.service
[Service]
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override
2022-03-20 20:54:52 +01:00
Slice=drone.slice
Delegate=yes
feat: added Unit file for drone
2020-05-29 12:58:04 +02:00
Restart=always
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override
2022-03-20 20:54:52 +01:00
RestartSec=5
ExecStart=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml up
ExecStop=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml stop
Nice=-14
IOSchedulingClass=1
IOSchedulingPriority=0
CapabilityBoundingSet=
# ProtectProc=invisible
ProtectHome=true
RestrictNamespaces=uts ipc pid user cgroup
NoNewPrivileges=True
# SecureBits=noroot-locked
ProtectSystem=strict
PrivateTmp=true
PrivateDevices=true
PrivateUsers=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true
# SystemCallFilter=~memfd_create
SystemCallArchitectures=native
feat: added Unit file for drone
2020-05-29 12:58:04 +02:00
[Install]
WantedBy=multi-user.target
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override
2022-03-20 20:54:52 +01:00
chore(vim): set filetype
2022-03-20 21:03:24 +01:00
# vim: ft=systemd