drone-ci-configs/etc/systemd/system/drone.service

# /etc/systemd/system/drone.service
[Unit]
Description=Drone server
After=docker.service
Upholds=nginx.service docker.service

[Service]
Slice=drone.slice
Delegate=no
Restart=on-abnormal
RestartSec=15s

Environment=COMPOSE_FILE=/etc/drone/docker-compose.yml
ExecStartPre=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml down
ExecStart=/usr/bin/docker-compose    -p drone -f /etc/drone/docker-compose.yml up --remove-orphans
ExecStop=/usr/bin/docker-compose     -p drone -f /etc/drone/docker-compose.yml stop

Nice=-14
IOSchedulingClass=1
IOSchedulingPriority=0

CapabilityBoundingSet=
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_CHROOT CAP_AUDIT_*

SystemCallFilter=~memfd_create @reboot @swap @cpu-emulation @debug @module @clock @raw-io @obsolete
ProtectProc=invisible
ProcSubset=pid
ProtectHome=true
RestrictNamespaces=true
NoNewPrivileges=True
# SecureBits=noroot-locked
ProtectSystem=strict
PrivateTmp=true
PrivateDevices=true
PrivateUsers=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target

# vim: ft=systemd
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`# /etc/systemd/system/drone.service`
feat: added Unit file for drone 2020-05-29 12:58:04 +02:00			`[Unit]`
			`Description=Drone server`
systemd: adjust dependency relations 2022-09-28 16:31:01 +02:00			`After=docker.service`
			`Upholds=nginx.service docker.service`
feat: added Unit file for drone 2020-05-29 12:58:04 +02:00
			`[Service]`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`Slice=drone.slice`
systemd: stop delegating cgroups 2022-09-28 16:29:50 +02:00			`Delegate=no`
systemd,compose: adjust restart policy 2022-09-28 16:35:26 +02:00			`Restart=on-abnormal`
systemd: increase restart timeout to 15s 2022-09-28 16:31:19 +02:00			`RestartSec=15s`

systemd: use Environment for DRYness 2022-09-28 16:28:38 +02:00			`Environment=COMPOSE_FILE=/etc/drone/docker-compose.yml`
systemd: add ExecStartPre directive 2022-09-28 16:31:50 +02:00			`ExecStartPre=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml down`
			`ExecStart=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml up --remove-orphans`
			`ExecStop=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml stop`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00
			`Nice=-14`
			`IOSchedulingClass=1`
			`IOSchedulingPriority=0`

			`CapabilityBoundingSet=`
tighten Capabilities and SystemCallFilter list 2022-04-20 16:51:05 +02:00			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_CHROOT CAP_AUDIT_*`

systemd(SystemCallFilter=~): allow resources group 2022-09-28 16:32:40 +02:00			`SystemCallFilter=~memfd_create @reboot @swap @cpu-emulation @debug @module @clock @raw-io @obsolete`
set ProtectProc,ProcSubset 2022-04-20 16:52:11 +02:00			`ProtectProc=invisible`
			`ProcSubset=pid`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`ProtectHome=true`
restrict all namespaces 2022-04-20 16:52:59 +02:00			`RestrictNamespaces=true`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`NoNewPrivileges=True`
			`# SecureBits=noroot-locked`
			`ProtectSystem=strict`
			`PrivateTmp=true`
			`PrivateDevices=true`
			`PrivateUsers=true`
			`ProtectHostname=true`
			`ProtectClock=true`
			`ProtectKernelTunables=true`
			`ProtectKernelModules=true`
			`ProtectKernelLogs=true`
			`ProtectControlGroups=true`
			`LockPersonality=true`
			`MemoryDenyWriteExecute=true`
set RestrictAddressFamilies to unix,ipv4,ipv6 2022-04-20 16:54:52 +02:00			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`RestrictRealtime=true`
			`RestrictSUIDSGID=true`
			`SystemCallArchitectures=native`
feat: added Unit file for drone 2020-05-29 12:58:04 +02:00
			`[Install]`
			`WantedBy=multi-user.target`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00
chore(vim): set filetype 2022-03-20 21:03:24 +01:00			`# vim: ft=systemd`