abrown38andClaude Opus 5.5
ecf4129877
systemctl reload guard, guard reload or SIGHUP reads the configuration again: a watch keeps its bounties and counts under the same name and takes its new settings at once; its source starts again only if it changed; watches gone stop, new ones start; a file with a mistake is refused. The Housecarl connection, state, socket and log wait for a restart, and guard reload says so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
58 lines
1.7 KiB
Desktop File
58 lines
1.7 KiB
Desktop File
# Guard: watches logs and bans misbehaving addresses at the firewall
|
|
# (Housecarl's ban lists). Installed as /etc/systemd/system/guard.service
|
|
# (see docs/install.md).
|
|
[Unit]
|
|
Description=Guard: bans addresses that misbehave in the logs, at the firewall
|
|
Documentation=file:///usr/local/share/doc/guard/README.md
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
ExecStart=/usr/local/bin/guard --config /etc/guard/guard.yaml run
|
|
# systemctl reload guard: guard.yaml again, keeping the bounties.
|
|
ExecReload=/usr/local/bin/guard --config /etc/guard/guard.yaml reload
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
|
|
User=guard
|
|
Group=guard
|
|
# Reading logs: /var/log's files (adm) and the journal (systemd-journal).
|
|
# On the firewall, add housecarl to use Housecarl's local socket.
|
|
SupplementaryGroups=adm systemd-journal
|
|
UMask=0027
|
|
|
|
# /var/lib/guard: the state (repeat offenders, bans waiting for
|
|
# Housecarl). /run/guard: the socket guard status asks.
|
|
StateDirectory=guard
|
|
StateDirectoryMode=0750
|
|
ConfigurationDirectory=guard
|
|
ConfigurationDirectoryMode=0750
|
|
RuntimeDirectory=guard
|
|
RuntimeDirectoryMode=0750
|
|
|
|
# Sandboxing: Guard only reads logs and talks to Housecarl.
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|