35 lines
859 B
INI
35 lines
859 B
INI
[Unit]
|
|
Description=BookWyrm
|
|
After=network.target postgresql.service redis.service
|
|
|
|
[Service]P
|
|
User=bookwyrm
|
|
Group=bookwyrm
|
|
WorkingDirectory=/opt/bookwyrm
|
|
ExecStart=/opt/bookwyrm/venv/bin/gunicorn bookwyrm.wsgi:application --threads=8 --bind 0.0.0.0:8000
|
|
StandardOutput=journal
|
|
StandardError=inherit
|
|
ProtectSystem=strict
|
|
ProtectHome=tmpfs
|
|
InaccessiblePaths=-/media -/mnt -/srv
|
|
PrivateTmp=yes
|
|
TemporaryFileSystem=/var /run /opt
|
|
PrivateUsers=true
|
|
PrivateDevices=true
|
|
BindReadOnlyPaths=/opt/bookwyrm
|
|
BindPaths=/opt/bookwyrm/images /opt/bookwyrm/static /var/run/postgresql
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=true
|
|
PrivateMounts=true
|
|
ProtectHostname=true
|
|
ProtectClock=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectControlGroups=true
|
|
RestrictRealtime=true
|
|
RestrictNamespaces=net
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|