diff options
| author | Ahmed AbdelHalim <[email protected]> | 2025-09-09 23:42:40 +0200 |
|---|---|---|
| committer | Ahmed AbdelHalim <[email protected]> | 2025-09-09 23:42:40 +0200 |
| commit | b9179506b83c6c3c58a15bf8e379fb9a8bc8e819 (patch) | |
| tree | 3d4dd6699be5662fa61ad0f991ed200a1d6d16d2 /deployment | |
| parent | b17a2214113ec7c8f81390b5f6241446eb820149 (diff) | |
Fix systemd service to work with wireguard
Diffstat (limited to 'deployment')
| -rw-r--r-- | deployment/wg-portal.service | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/deployment/wg-portal.service b/deployment/wg-portal.service index 23d9dad..e68f04c 100644 --- a/deployment/wg-portal.service +++ b/deployment/wg-portal.service @@ -17,13 +17,15 @@ TimeoutStartSec=30 TimeoutStopSec=30 # Security hardening -NoNewPrivileges=true +# NoNewPrivileges=true can't work becasue it's needed for sudo wg commands +NoNewPrivileges=false ProtectSystem=strict ProtectHome=true ReadWritePaths=/etc/wireguard PrivateTmp=true PrivateDevices=true -ProtectKernelTunables=true +# ProtectKernelTunables=true prevents the service from writing to /proc/sys/* paths, sudo wg quick up fails +ProtectKernelTunables=false ProtectKernelModules=true ProtectControlGroups=true RestrictSUIDSGID=true |