mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-08-30 09:07:40 -05:00
kolaente
cbd33ef8cb
The os packages previously stored the sqlite database and all other runtime data in /opt/vikunja, next to the binary. Fresh installs now default to /var/lib/vikunja, which is the correct FHS location for variable state data. The package creates the directory and the service units use it as their working directory. BREAKING CHANGE: New installations store their data in /var/lib/vikunja instead of /opt/vikunja. Existing installations keep their current config and are unaffected, but setups relying on the old default path for new machines need to move their data or adjust the config.
51 lines
1.3 KiB
Desktop File
51 lines
1.3 KiB
Desktop File
[Unit]
|
|
Description=Vikunja
|
|
After=syslog.target
|
|
After=network.target
|
|
# Depending on how you configured Vikunja, you may want to uncomment these:
|
|
#Requires=mysql.service
|
|
#Requires=mariadb.service
|
|
#Requires=postgresql.service
|
|
#Requires=redis.service
|
|
|
|
[Service]
|
|
RestartSec=2s
|
|
Type=simple
|
|
WorkingDirectory=/var/lib/vikunja
|
|
ExecStart=/usr/local/bin/vikunja
|
|
Restart=always
|
|
|
|
# Hardening
|
|
NoNewPrivileges=yes
|
|
ProtectProc=invisible
|
|
ProcSubset=pid
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
PrivateDevices=yes
|
|
RestrictNamespaces=yes
|
|
RestrictSUIDSGID=yes
|
|
RestrictRealtime=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources
|
|
# Return ENOSYS instead of killing the process when a syscall is not in the
|
|
# allowlist. Syscalls newer than systemd's table can never be allowlisted, so
|
|
# killing breaks runtimes that probe for them on new kernels (#3252).
|
|
SystemCallErrorNumber=ENOSYS
|
|
|
|
# If you want to bind Vikunja to a port below 1024 uncomment
|
|
# the two values below
|
|
###
|
|
#CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
#AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|