| 1234567891011121314151617181920212223242526272829303132333435 |
- [Unit]
- Description=tPSGI for __DOMAIN__
- Wants=multi-user.target
- After=multi-user.target
- [Install]
- WantedBy=multi-user.target
- [Service]
- Type=forking
- PIDFile=__REPLACEME__/run/tpsgi.pid
- Environment=PATH='__PERL5BIN__' HOME=__REPLACEME__/
- ExecStart=__REPLACEME__/service/tpsgi.sh
- WorkingDirectory=__REPLACEME__/
- Restart=always
- OOMPolicy=stop
- ExecReload=kill -HUP $MAINPID
- AmbientCapabilities=CAP_SYS_RESOURCE CAP_SYS_NICE
- LockPersonality=yes
- MemoryDenyWriteExecute=yes
- OOMPolicy=continue
- PrivateDevices=yes
- PrivateTmp=true
- ProtectClock=yes
- ProtectControlGroups=yes
- ProtectHome=read-only
- ProtectHostname=yes
- ProtectKernelLogs=yes
- ProtectKernelModules=yes
- ProtectKernelTunables=yes
- ProtectSystem=yes
- RestrictNamespaces=yes
- RestrictRealtime=yes
- RestrictSUIDSGID=yes
- NoNewPrivileges=yes
|
