vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Blame · packaging/systemd/vole.service

Line attribution on main · 81 line(s)

View file History

3b39a84c Keenan Nemetz 14d ago	1	[Unit]
3b39a84c Keenan Nemetz 14d ago	2	Description=Vole software forge
ed03b3d1 Keenan Nemetz 3h ago	3	Documentation=https://rodent.software/vole
3b39a84c Keenan Nemetz 14d ago	4	After=network-online.target
	5	Wants=network-online.target
	6
	7	[Service]
	8	Type=simple
	9	User=vole
	10	Group=vole
	11	ExecStart=/usr/bin/vole serve --config /etc/vole/vole.toml
	12	Restart=on-failure
	13	RestartSec=2s
	14
73755a56 Keenan Nemetz 9d ago	15	# A clean stop stops handing out jobs and gives the ones already leased up to a
	16	# minute to report, then closes the HTTP listeners with a 20 second budget. Leave
	17	# room above both so systemd does not kill the drain early.
	18	TimeoutStopSec=100s
	19
ed181212 Keenan Nemetz 13d ago	20	# Everything the service creates is group-readable at most: 0027 gives the
	21	# service account rw, the vole group r, and everybody else nothing. Vole creates
	22	# its own secrets at 0600 regardless, but a umask is what covers the files git,
	23	# sqlite and the ACME client create on its behalf.
	24	UMask=0027
	25
3b39a84c Keenan Nemetz 14d ago	26	# The instance lives in /var/lib/vole. systemd creates and owns it, and with
	27	# ProtectSystem=strict it is the only writable directory the service gets.
	28	StateDirectory=vole
	29	StateDirectoryMode=0750
	30	ConfigurationDirectory=vole
	31
	32	# Vole runs git for every push and read, so a busy instance has many children.
	33	LimitNOFILE=65536
	34
ed181212 Keenan Nemetz 13d ago	35	# A core dump of this process is a copy of the SSH host key, the roster and any
	36	# private key in memory.
	37	LimitCORE=0
	38
	39	# No capabilities at all. The SSH listener is 2222 in the packaged config; to
	40	# serve SSH or automatic HTTPS on a port below 1024, a drop-in must re-grant the
	41	# one capability that needs, which means adding it here as well:
	42	#
	43	# [Service]
	44	# CapabilityBoundingSet=CAP_NET_BIND_SERVICE
	45	# AmbientCapabilities=CAP_NET_BIND_SERVICE
	46	CapabilityBoundingSet=
	47
3b39a84c Keenan Nemetz 14d ago	48	NoNewPrivileges=true
3b39a84c Keenan Nemetz 14d ago	49	PrivateTmp=true
ed181212 Keenan Nemetz 13d ago	50	PrivateDevices=true
3b39a84c Keenan Nemetz 14d ago	51	ProtectSystem=strict
	52	ProtectHome=true
	53	ProtectClock=true
	54	ProtectHostname=true
	55	ProtectKernelTunables=true
	56	ProtectKernelModules=true
ed181212 Keenan Nemetz 13d ago	57	ProtectKernelLogs=true
3b39a84c Keenan Nemetz 14d ago	58	ProtectControlGroups=true
	59	RestrictNamespaces=true
	60	RestrictRealtime=true
	61	RestrictSUIDSGID=true
	62	LockPersonality=true
	63	SystemCallArchitectures=native
ed181212 Keenan Nemetz 13d ago	64	RemoveIPC=true
	65
	66	# AF_NETLINK is not a network client: libc reads interface and address changes
	67	# through it. Everything the forge needs to reach is unix sockets, TCP and UDP.
	68	RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
	69
	70	# Other processes' command lines, environment and file descriptors are not this
	71	# service's business, and a git child does not need to see them.
	72	ProtectProc=invisible
	73	ProcSubset=pid
	74
	75	# Go does not generate code at run time. The container runtime a CI runner needs
	76	# runs in the runner's own unit, not here, so nothing in this process wants a
	77	# writable-and-executable mapping.
	78	MemoryDenyWriteExecute=true
3b39a84c Keenan Nemetz 14d ago	79
	80	[Install]
	81	WantedBy=multi-user.target