drone-ci-configs/etc/systemd/system/drone.service

# /etc/systemd/system/drone.service
[Unit]
Description=Drone server
After=docker.service nginx.service

[Service]
Slice=drone.slice
Delegate=yes
Restart=always
RestartSec=5
ExecStart=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml up --remove-orphans
ExecStop=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml stop

Nice=-14
IOSchedulingClass=1
IOSchedulingPriority=0

CapabilityBoundingSet=
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_CHROOT CAP_AUDIT_*

SystemCallFilter=~memfd_create @reboot @swap @resources @cpu-emulation @debug @module @clock @raw-io @obsolete
ProtectProc=invisible
ProcSubset=pid
ProtectHome=true
RestrictNamespaces=true
NoNewPrivileges=True
# SecureBits=noroot-locked
ProtectSystem=strict
PrivateTmp=true
PrivateDevices=true
PrivateUsers=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target

# vim: ft=systemd
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`# /etc/systemd/system/drone.service`
feat: added Unit file for drone 2020-05-29 12:58:04 +02:00			`[Unit]`
			`Description=Drone server`
			`After=docker.service nginx.service`

			`[Service]`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`Slice=drone.slice`
			`Delegate=yes`
feat: added Unit file for drone 2020-05-29 12:58:04 +02:00			`Restart=always`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`RestartSec=5`
run service with "--remove-orphans" 2022-04-20 16:49:23 +02:00			`ExecStart=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml up --remove-orphans`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`ExecStop=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml stop`

			`Nice=-14`
			`IOSchedulingClass=1`
			`IOSchedulingPriority=0`

			`CapabilityBoundingSet=`
tighten Capabilities and SystemCallFilter list 2022-04-20 16:51:05 +02:00			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_CHROOT CAP_AUDIT_*`

			`SystemCallFilter=~memfd_create @reboot @swap @resources @cpu-emulation @debug @module @clock @raw-io @obsolete`
set ProtectProc,ProcSubset 2022-04-20 16:52:11 +02:00			`ProtectProc=invisible`
			`ProcSubset=pid`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`ProtectHome=true`
restrict all namespaces 2022-04-20 16:52:59 +02:00			`RestrictNamespaces=true`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00			`NoNewPrivileges=True`
			`# SecureBits=noroot-locked`
			`ProtectSystem=strict`
			`PrivateTmp=true`
			`PrivateDevices=true`
			`PrivateUsers=true`
			`ProtectHostname=true`
			`ProtectClock=true`
			`ProtectKernelTunables=true`
			`ProtectKernelModules=true`
			`ProtectKernelLogs=true`
			`ProtectControlGroups=true`
			`LockPersonality=true`
			`MemoryDenyWriteExecute=true`
			`RestrictRealtime=true`
			`RestrictSUIDSGID=true`
			`SystemCallArchitectures=native`
feat: added Unit file for drone 2020-05-29 12:58:04 +02:00
			`[Install]`
			`WantedBy=multi-user.target`
manage system access of the service using systemd * add drone.slice (control resource usage) * restrict can be accessed by the service * adjust IO priority and NICEness of processes created withing the service * use "-p" with docker-compose invocation to specify a project that the newly-spawned containers belong to (best practice) * add commented override 2022-03-20 20:54:52 +01:00
chore(vim): set filetype 2022-03-20 21:03:24 +01:00			`# vim: ft=systemd`