scripts/eitri-oidc.service

Ref: main v0.0.5   Size: 1.4 KiB   History

# eitri bundled OIDC issuer systemd unit. Install on the box that hosts it:
#
#   sudo useradd --system --home-dir /var/lib/eitri-oidc --shell /usr/sbin/nologin eitri-oidc
#   sudo cp eitri-oidc.service /etc/systemd/system/
#   sudo systemctl daemon-reload && sudo systemctl enable --now eitri-oidc
#
# Sibling to eitri-server: deploy it only for a bundled-OIDC install; a fleet
# fronted by an external IdP never needs this unit.
#
# Runs as the dedicated 'eitri-oidc' user — this daemon handles passwords and
# holds the identity signing key, so it must never run as root, and a separate
# user from eitri-server keeps that key material unreadable by the server
# process. Config is root-owned in /etc/eitri; the mutable pieces (the flat
# user file, the autogenerated signing key) live in /var/lib/eitri-oidc, which
# StateDirectory= creates and owns. Manage users as the service user so files
# stay readable by it:
#
#   sudo -u eitri-oidc eitri-oidc user add you@example.com

[Unit]
Description=eitri bundled OIDC issuer
Documentation=https://eitri.sh
After=network-online.target
Wants=network-online.target

[Service]
User=eitri-oidc
Group=eitri-oidc
ExecStart=/usr/local/bin/eitri-oidc -config /etc/eitri/eitri-oidc.json
StateDirectory=eitri-oidc
Restart=on-failure
RestartSec=5
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes

[Install]
WantedBy=multi-user.target