blob: e68f04c9e24d4406b102a77e9d062771d7fefc59 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
[Unit]
Description=WireGuard Portal Web Interface
Documentation=https://git.sr.ht/~a14m/wg-portal
After=network-online.target
Wants=network-online.target
Requires=network.target
[Service]
Type=simple
User=wg-portal
Group=wg-portal
ExecStart=/etc/wg-portal/wg-portal
WorkingDirectory=/etc/wg-portal
Restart=always
RestartSec=5
TimeoutStartSec=30
TimeoutStopSec=30
# Security hardening
# NoNewPrivileges=true can't work becasue it's needed for sudo wg commands
NoNewPrivileges=false
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/etc/wireguard
PrivateTmp=true
PrivateDevices=true
# ProtectKernelTunables=true prevents the service from writing to /proc/sys/* paths, sudo wg quick up fails
ProtectKernelTunables=false
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=wg-portal
[Install]
WantedBy=multi-user.target
|
