adamandClaude Opus 5.5
113a6913a2
The DNSSEC tab and 'jarl zone dnssec status' give the jarl record add command (and an Add to parent button) when the parent zone is in Jarl. jarl.service grants CAP_NET_BIND_SERVICE so the web UI can listen on 443. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
66 lines
2.0 KiB
Desktop File
66 lines
2.0 KiB
Desktop File
# Jarl daemon: web UI and REST API for managing BIND.
|
|
# Installed as /etc/systemd/system/jarl.service (see docs/install.md).
|
|
[Unit]
|
|
Description=Jarl BIND manager (web UI and API)
|
|
Documentation=file:///usr/local/share/doc/jarl/README.md
|
|
After=network-online.target named.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=main
|
|
ExecStart=/usr/local/bin/jarld --config /etc/jarl/jarl.yaml serve
|
|
# SIGHUP rereads the TLS certificate.
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
|
|
User=jarl
|
|
Group=jarl
|
|
# Membership of 'bind' lets jarld read /etc/bind/rndc.key and the rest of
|
|
# named's configuration (for rndc and named-checkconf) and give generated
|
|
# files to group bind so named can read them.
|
|
SupplementaryGroups=bind
|
|
UMask=0027
|
|
|
|
# /var/lib/jarl: database and staging area.
|
|
StateDirectory=jarl
|
|
StateDirectoryMode=0750
|
|
ConfigurationDirectory=jarl
|
|
ConfigurationDirectoryMode=0750
|
|
# /run/jarl: the local API socket (jarl.sock), for root and the jarl user.
|
|
RuntimeDirectory=jarl
|
|
RuntimeDirectoryMode=0750
|
|
|
|
# Sandboxing. jarld may only write its own state and the directories it
|
|
# manages for named (created by tmpfiles.d/jarl.conf).
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/etc/bind/jarl /var/lib/bind/jarl /var/cache/bind/jarl
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
NoNewPrivileges=yes
|
|
# The only privilege jarld gets: listening on ports below 1024 (443 for the
|
|
# web UI). Nothing else, and NoNewPrivileges still applies.
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
SystemCallArchitectures=native
|
|
# @system-service includes @chown, which jarld needs to give files to group bind.
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|