nebula/nebula.service
Fabio Alessandro Locati 63137600d8
Make it safer
2023-08-04 14:35:43 +01:00

38 lines
1.0 KiB
Desktop File

[Unit]
Description=Nebula overlay networking tool
After=basic.target network.target network-online.target
Before=sshd.service
Wants=basic.target network-online.target nss-lookup.target time-sync.target
[Service]
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/bin/nebula -config /etc/nebula/config.yml
SyslogIdentifier=nebula
#CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
CapabilityBoundingSet=CAP_NET_ADMIN
RestrictNamespaces=yes
WorkingDirectory=/etc/nebula
ProtectClock=true
ProtectSystem=strict
ProtectHostname=yes
ProtectHome=yes
PrivateHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
NoNewPrivileges=yes
PrivateTmp=yes
UMask=0077
RestrictAddressFamilies=AF_NETLINK AF_INET AF_INET6
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
PrivateTmp=true
ProtectSystem=true
ProtectHome=true
[Install]
WantedBy=multi-user.target