adamandClaude Opus 5.5
aca0abc780
systemctl restart/status jarld now work too. The package relinks a unit enabled by an older version on upgrade, so the alias appears without re-enabling; make uninstall removes the link. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
70 lines
2.2 KiB
Desktop File
70 lines
2.2 KiB
Desktop File
# Jarl daemon: web UI and REST API for managing BIND.
|
|
# Installed as /etc/systemd/system/jarl.service (see docs/install.md).
|
|
[Unit]
|
|
Description=Jarl BIND manager (web UI and API)
|
|
Documentation=file:///usr/local/share/doc/jarl/README.md
|
|
After=network-online.target named.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=main
|
|
ExecStart=/usr/local/bin/jarld --config /etc/jarl/jarl.yaml serve
|
|
# SIGHUP rereads the TLS certificate.
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
|
|
User=jarl
|
|
Group=jarl
|
|
# Membership of 'bind' lets jarld read /etc/bind/rndc.key and the rest of
|
|
# named's configuration (for rndc and named-checkconf) and give generated
|
|
# files to group bind so named can read them.
|
|
SupplementaryGroups=bind
|
|
UMask=0027
|
|
|
|
# /var/lib/jarl: database and staging area.
|
|
StateDirectory=jarl
|
|
StateDirectoryMode=0750
|
|
ConfigurationDirectory=jarl
|
|
ConfigurationDirectoryMode=0750
|
|
# /run/jarl: the local API socket (jarl.sock), for root and the jarl user.
|
|
RuntimeDirectory=jarl
|
|
RuntimeDirectoryMode=0750
|
|
|
|
# Sandboxing. jarld may only write its own state and the directories it
|
|
# manages for named (created by tmpfiles.d/jarl.conf).
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/etc/bind/jarl /var/lib/bind/jarl /var/cache/bind/jarl
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
NoNewPrivileges=yes
|
|
# The only privilege jarld gets: listening on ports below 1024 (443 for the
|
|
# web UI). Nothing else, and NoNewPrivileges still applies.
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
# AF_NETLINK lets jarld list this host's addresses, so its name server
|
|
# checks know which addresses are its own.
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
|
SystemCallArchitectures=native
|
|
# @system-service includes @chown, which jarld needs to give files to group bind.
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
# 'systemctl restart jarld' works too (the daemon's binary is jarld).
|
|
Alias=jarld.service
|