Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added sample systemd service file #54

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Added sample systemd service file #54

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d2bf31d
Added sample systemd service file
szarka Dec 17, 2024
0077a20
Change binary location. Remove PIDFile. Replace StateDirectory with L…
szarka Dec 21, 2024
edaa0a2
Merge branch 'OCEAN-xyz:master' into szarka-init-patch
szarka Dec 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 89 additions & 0 deletions contrib/init/datum_gateway.service
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,89 @@
[Unit]
Description=DATUM Gateway
Documentation=https://github.com/OCEAN-xyz/datum_gateway

#
# Expected file locations when using hardening options:
# binary: /usr/bin/datum/
# configuration: /etc/datum/
# logs: /var/lib/datum_gateway/
#

# https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/
Wants=network-online.target
After=network-online.target
# alternatively, wait until bitcoind is up
#After=bitcoind.service
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently, datum_gateway will fail to start if bitcoind isn't responsive - so maybe this should be uncommented?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, it starts if bitcoind is unresponsive. It just doesn't do anything useful, except log a lot of errors. But the reason for leaving After=bitcoind.service line uncommented was simply that someone might be configuring datum to run via systemd without configuring bitcoind to run via systemd. But could leave it uncommented and have the comment say instead to remove it if bitcoind isn't configured via systemd.


[Service]

ExecStart=/usr/bin/datum/datum_gateway --config=/etc/datum/datum_gateway_config.json
szarka marked this conversation as resolved.
Show resolved Hide resolved

# Make sure the config directory is readable by the service user
PermissionsStartOnly=true
ExecStartPre=/bin/chgrp datum /etc/datum

#
# Process Management
#

Type=simple
NotifyAccess=all
PIDFile=/run/datum/datum_gateway.pid
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does systemd create the directory for us?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, systemd dynamically creates the directory on start and then deletes it on stop.


Restart=on-failure
TimeoutStartSec=infinity
TimeoutStopSec=600

# limit number of open file descriptors
LimitNOFILE=65535

#
# Directory Creation & Permissions
#

User=datum
Group=datum

# /run/datum_gateway
RuntimeDirectory=datum_gateway
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't match PIDFile above

Copy link
Contributor Author

@szarka szarka Dec 20, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo in the path for PIDFile. Would fix, but… Actually, PIDFile isn't even needed when running with Type=simple. Will delete PIDFile instead.

RuntimeDirectoryMode=0710

# /etc/datum
ConfigurationDirectory=datum
ConfigurationDirectoryMode=0710

# /var/lib/datum_gateway
StateDirectory=datum_gateway
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is this for?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A case of me following the bitcoind example too closely, I think. Removing this section and replacing with LogsDirectory pointed at /var/log/datum_gateway instead.

StateDirectoryMode=0710

#
# Hardening
#

# Provide a private /tmp and /var/tmp
PrivateTmp=true

# Mount /usr, /boot/ and /etc read-only for the process
ProtectSystem=full

# Deny access to /home, /root and /run/user
ProtectHome=true

# Disallow the process and all of its children to gain
# new privileges through execve()
NoNewPrivileges=true

# Use a new /dev namespace only populated with API pseudo devices
# such as /dev/null, /dev/zero and /dev/random
PrivateDevices=true

# Deny the creation of writable and executable memory mappings
MemoryDenyWriteExecute=true

# Restrict ABIs to help ensure MemoryDenyWriteExecute is enforced
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target