initial commit

systemd/terraria@.service

@@ -0,0 +1,48 @@
+[Unit]
+Description=Terraria server (%i)
+Documentation=file://@DOCDIR@/README.md
+After=network-online.target terraria@%i.socket
+Wants=network-online.target
+# The socket unit provides a FIFO used as the server's console (stdin).
+Requires=terraria@%i.socket
+
+[Service]
+Type=simple
+User=terraria
+Group=terraria
+
+# Creates the instance directory and default configs, unpacks the server zip if needed
+ExecStartPre=@BINDIR@/terractl prepare %i
+# Execs the vanilla or tModLoader server depending on instance.conf
+ExecStart=@BINDIR@/terractl run %i
+# Sends "exit" to the console (saves the world) and waits for shutdown
+ExecStop=@BINDIR@/terractl stop %i $MAINPID
+
+StandardInput=socket
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=terraria-%i
+
+TimeoutStartSec=10min
+TimeoutStopSec=90
+Restart=on-failure
+RestartSec=10
+UMask=0027
+
+# Hardening. Only the instances directory is writable; server zips are read-only.
+# If you move TERRARIA_BASE in /etc/default/terractl, add a drop-in
+# (systemctl edit terraria@.service) with ReadWritePaths=<new location>.
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/terraria/instances
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+
+[Install]
+WantedBy=multi-user.target

systemd/terraria@.socket

@@ -0,0 +1,12 @@
+[Unit]
+Description=Terraria server console FIFO (%i)
+# Stopping the service also stops (and removes) its console FIFO
+PartOf=terraria@%i.service
+
+[Socket]
+ListenFIFO=%t/terraria/%i.stdin
+SocketUser=terraria
+SocketGroup=terraria
+SocketMode=0660
+DirectoryMode=0755
+RemoveOnStop=true