scripts/eitri-server.service

Ref: main v0.0.5   Size: 1.4 KiB   History

# eitri control plane systemd unit. Install on the server box:
#
#   sudo useradd --system --home-dir /var/lib/eitri --shell /usr/sbin/nologin eitri
#   sudo cp eitri-server.service /etc/systemd/system/
#   sudo systemctl daemon-reload && sudo systemctl enable --now eitri-server
#
# Runs as the dedicated 'eitri' user: the server needs no privilege — every
# listener (console 8080/tcp, sync 8443/udp, SSH gate 2222/tcp) sits on an
# unprivileged port and its state (sqlite, SSH CA keys) lives in
# /var/lib/eitri, which StateDirectory= creates and owns for it. Config stays
# root-owned in /etc/eitri, readable via the 'eitri' group.

[Unit]
Description=eitri control plane
Documentation=https://eitri.sh
After=network-online.target
Wants=network-online.target

[Service]
User=eitri
Group=eitri
ExecStart=/usr/local/bin/eitri-server --config /etc/eitri/server.json
StateDirectory=eitri
Restart=on-failure
RestartSec=5
# Same stated budget as the agent, for the same reason: what this process holds
# open is decided by how many people are using the fleet, not by the box. Every
# gate session is a pair of connections and every open console is a stream that
# lives as long as the browser tab does, so the descriptor count follows the
# fleet's use and should not sit on a distro default nobody chose.
LimitNOFILE=65536
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes

[Install]
WantedBy=multi-user.target