sftpgo-mirror/init/sftpgo.service

[Unit]
Description=SFTPGo Server
After=network.target

[Service]
User=sftpgo
Group=sftpgo
Type=simple
WorkingDirectory=/etc/sftpgo
Environment=SFTPGO_CONFIG_DIR=/etc/sftpgo/
Environment=SFTPGO_LOG_FILE_PATH=
EnvironmentFile=-/etc/sftpgo/sftpgo.env
ExecStart=/usr/bin/sftpgo serve
ExecReload=/bin/kill -s HUP $MAINPID
LimitNOFILE=8192
KillMode=mixed
PrivateTmp=true
Restart=always
RestartSec=10s
NoNewPrivileges=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX

[Install]
WantedBy=multi-user.target
first version 2019-07-20 10:26:52 +00:00			`[Unit]`
add some examples hooks for one time password logins The examples use Twillo Authy since I use it for my GitHub account. You can easily use other multi factor authentication software in a similar way. 2020-08-18 19:21:01 +00:00			`Description=SFTPGo Server`
first version 2019-07-20 10:26:52 +00:00			`After=network.target`

			`[Service]`
systemd unit: run as "sftpgo" system user Update the docs too Fixes #177 2020-09-25 16:23:04 +00:00			`User=sftpgo`
			`Group=sftpgo`
first version 2019-07-20 10:26:52 +00:00			`Type=simple`
			`WorkingDirectory=/etc/sftpgo`
Add `Environment` & `EnvironmentFile` directives Since we can now override settings through environment variables, it's handy to contain those changes in a separate file. This way, sysadmins can generate such a file without having to touch the systemd file. Meanwhile the current flags are converted to `Environment` entries, which can be overridden in the `EnvironmentFile` if so desired. If the file is not present, the directive [is ignored](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#EnvironmentFile=) 2019-08-05 12:26:26 +00:00			`Environment=SFTPGO_CONFIG_DIR=/etc/sftpgo/`
Log to journald By default on systems with systemd, send logs to stdout and thus to journald. 2019-09-20 10:34:17 +00:00			`Environment=SFTPGO_LOG_FILE_PATH=`
Add `Environment` & `EnvironmentFile` directives Since we can now override settings through environment variables, it's handy to contain those changes in a separate file. This way, sysadmins can generate such a file without having to touch the systemd file. Meanwhile the current flags are converted to `Environment` entries, which can be overridden in the `EnvironmentFile` if so desired. If the file is not present, the directive [is ignored](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#EnvironmentFile=) 2019-08-05 12:26:26 +00:00			`EnvironmentFile=-/etc/sftpgo/sftpgo.env`
switch to viper for configuration and use cobra for cli 2019-08-07 20:46:13 +00:00			`ExecStart=/usr/bin/sftpgo serve`
systemd service: add ExecReload 2020-04-05 09:36:29 +00:00			`ExecReload=/bin/kill -s HUP $MAINPID`
systemd unit: set LimitNOFILE to 8192 2021-09-19 15:37:18 +00:00			`LimitNOFILE=8192`
first version 2019-07-20 10:26:52 +00:00			`KillMode=mixed`
ftpd: fix TLS for active connections See https://github.com/fclairamb/ftpserverlib/issues/177 Some minor doc improvements 2020-09-17 07:45:40 +00:00			`PrivateTmp=true`
first version 2019-07-20 10:26:52 +00:00			`Restart=always`
			`RestartSec=10s`
systemd-security: add some easy wins We can tighten security by adding the following to the systemd service file: * NoNewPrivileges: should never be needed * DevicePolicy: only basics required * PrivateDevices: only needs mounted stuff, never devs * ProtectSystem: no need to change boot * RestrictAddressFamilies: INET, UNIX only Signed-off-by: Marc <mail@lpcvoid.com> 2022-01-15 10:03:51 +00:00			`NoNewPrivileges=yes`
			`PrivateDevices=yes`
			`DevicePolicy=closed`
			`ProtectSystem=true`
			`RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX`
first version 2019-07-20 10:26:52 +00:00
			`[Install]`
			`WantedBy=multi-user.target`