X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd-alex.git;a=blobdiff_plain;f=contrib%2Fngircd.service;h=e4c30e2525407b4523452792e695ab145d136b22;hp=f24ef60c320824f065ad46c7e9bb76ca90c3f3fc;hb=7ed22d0b22dc1ed624c3931e1cff9e21f4156bd9;hpb=2a52befa56eec493d4179c1568c7e6cd26d9ae23

diff --git a/contrib/ngircd.service b/contrib/ngircd.service
index f24ef60c..e4c30e25 100644
--- a/contrib/ngircd.service
+++ b/contrib/ngircd.service
@@ -1,20 +1,41 @@
+# ngIRCd systemd service unit.
+# See systemd(1), systemd.unit(5), systemd.service(5), systemd.exec(5).
+
 [Unit]
 Description=Next Generation IRC Daemon
+Documentation=man:ngircd(8) man:ngircd.conf(5) https://ngircd.barton.de
 After=network.target
+Wants=anope.service atheme.service irc-services.service
+Wants=bopm.service
+Before=anope.service atheme.service irc-services.service
+Before=bopm.service
 
 [Service]
 Type=forking
 User=irc
 Group=irc
-CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SYS_CHROOT CAP_NET_BIND_SERVICE
-PrivateTmp=yes
+# Settings & limits:
+CapabilityBoundingSet=CAP_SYS_CHROOT CAP_NET_BIND_SERVICE
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
 PrivateDevices=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
 ProtectSystem=full
-ProtectHome=true
-NoNewPrivileges=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictRealtime=yes
 RuntimeDirectory=ircd
 RuntimeDirectoryMode=750
-ExecStart=/usr/sbin/ngircd
+# Try to load "default files" from any Debian package variant to keep this
+# unit generic.
+EnvironmentFile=-/etc/default/ngircd
+EnvironmentFile=-/etc/default/ngircd-full
+EnvironmentFile=-/etc/default/ngircd-full-dbg
+# Start ngIRCd. Note: systemd doesn't allow to use $DAEMON here!
+ExecStart=/usr/sbin/ngircd $PARAMS
 ExecReload=/bin/kill -HUP $MAINPID
 Restart=on-failure