gotosocial/example/gotosocial.service

[Unit]
Description=GoToSocial Server

[Service]

# make sure this user and group exist and have read and write permissions in your GoToSocial folder.
# if they do not exist yet create them with "sudo useradd -r gotosocial"
# then give them permission with "chown -R gotosocial:gotosocial /gotosocial" (path to your gotosocial folder)
# you can adjust the users name according to your setup
User=gotosocial
Group=gotosocial

Type=exec
Restart=on-failure

# change if your path to the GoToSocial binary is different
ExecStart=/gotosocial/gotosocial --config-path config.yaml server start
WorkingDirectory=/gotosocial

StandardOutput=append:/var/log/gotosocial/access.log
StandardError=append:/var/log/gotosocial/error.log


# Sandboxing options to harden security
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
DevicePolicy=closed
ProtectSystem=full
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

# Denying access to capabilities that should not be relevant
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
# You might need this if you are running as non-root on a privileged port (below 1024)
#AmbientCapabilities=CAP_NET_BIND_SERVICE


[Install]
WantedBy=default.target

# After you are done editing this file move it to "/etc/systemd/system/gotosocial.service" and enable the service with "sudo systemctl enable --now gotosocial.service"
add example systemd service (#341) 2021-12-12 15:48:02 +01:00			`[Unit]`
			`Description=GoToSocial Server`

			`[Service]`

			`# make sure this user and group exist and have read and write permissions in your GoToSocial folder.`
			`# if they do not exist yet create them with "sudo useradd -r gotosocial"`
			`# then give them permission with "chown -R gotosocial:gotosocial /gotosocial" (path to your gotosocial folder)`
			`# you can adjust the users name according to your setup`
			`User=gotosocial`
			`Group=gotosocial`

			`Type=exec`
			`Restart=on-failure`

			`# change if your path to the GoToSocial binary is different`
			`ExecStart=/gotosocial/gotosocial --config-path config.yaml server start`
			`WorkingDirectory=/gotosocial`

[docs] Move and document logs (#1076) Rather than a single access log and no error logging, put the logs in /var/log/gotosocial/, and document creating and owning that directory 2022-11-19 10:06:37 +01:00			`StandardOutput=append:/var/log/gotosocial/access.log`
			`StandardError=append:/var/log/gotosocial/error.log`
[feature/security] Add systemd sandboxing options to harden security (#440) 2022-03-28 13:37:16 +02:00

			`# Sandboxing options to harden security`
			`# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html`
			`NoNewPrivileges=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6`
			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`DevicePolicy=closed`
			`ProtectSystem=full`
			`ProtectControlGroups=yes`
			`ProtectKernelModules=yes`
			`ProtectKernelTunables=yes`
			`LockPersonality=yes`
			`SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap`

			`# Denying access to capabilities that should not be relevant`
			`# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html`
			`CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD`
			`CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE`
			`CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT`
			`CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK`
			`CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM`
			`CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG`
			`CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE`
			`CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW`
			`CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG`
[docs] Mention `AmbientCapabilities=CAP_NET_BIND_SERVICE` in example systemd service (#576) 2022-05-16 10:55:21 +02:00			`# You might need this if you are running as non-root on a privileged port (below 1024)`
			`#AmbientCapabilities=CAP_NET_BIND_SERVICE`
[feature/security] Add systemd sandboxing options to harden security (#440) 2022-03-28 13:37:16 +02:00

add example systemd service (#341) 2021-12-12 15:48:02 +01:00			`[Install]`
			`WantedBy=default.target`

			`# After you are done editing this file move it to "/etc/systemd/system/gotosocial.service" and enable the service with "sudo systemctl enable --now gotosocial.service"`