mirror of
https://github.com/hanzoai/pubsub.git
synced 2026-10-30 15:06:26 +00:00
Phil Pennock
4f93ebf265
I switched the hardened example config file to use `Restart=always` in
6c22217f4 just over a year ago. That was a mistake.
If the nats-server is asked to shut down, and shuts down cleanly, then the
service manager should not restart it. The server should be restarted if it
exits on failure.
91 lines
2.4 KiB
Desktop File
91 lines
2.4 KiB
Desktop File
[Unit]
|
|
Description=NATS Server
|
|
After=network-online.target ntp.service
|
|
|
|
# If you use a dedicated filesystem for JetStream data, then you might use something like:
|
|
# ConditionPathIsMountPoint=/srv/jetstream
|
|
# See also Service.ReadWritePaths
|
|
|
|
[Service]
|
|
Type=simple
|
|
EnvironmentFile=-/etc/default/nats-server
|
|
ExecStart=/usr/sbin/nats-server -c /etc/nats-server.conf
|
|
ExecReload=/bin/kill -s HUP $MAINPID
|
|
|
|
# The nats-server uses SIGUSR2 to trigger Lame Duck Mode (LDM) shutdown
|
|
# https://docs.nats.io/running-a-nats-service/nats_admin/lame_duck_mode
|
|
ExecStop=/bin/kill -s SIGUSR2 $MAINPID
|
|
|
|
User=nats
|
|
Group=nats
|
|
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# This should be `lame_duck_duration` + some buffer to finish the shutdown.
|
|
# By default, `lame_duck_duration` is 2 mins.
|
|
TimeoutStopSec=150
|
|
|
|
# Capacity Limits
|
|
# JetStream requires 2 FDs open per stream.
|
|
LimitNOFILE=800000
|
|
# Environment=GOMEMLIMIT=12GiB
|
|
# You might find it better to set GOMEMLIMIT via /etc/default/nats-server,
|
|
# so that you can change limits without needing a systemd daemon-reload.
|
|
|
|
# Hardening
|
|
CapabilityBoundingSet=
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
NoNewPrivileges=true
|
|
PrivateDevices=true
|
|
PrivateTmp=true
|
|
PrivateUsers=true
|
|
ProcSubset=pid
|
|
ProtectClock=true
|
|
ProtectControlGroups=true
|
|
ProtectHome=true
|
|
ProtectHostname=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
ProtectSystem=strict
|
|
ReadOnlyPaths=
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
SystemCallFilter=@system-service ~@privileged ~@resources
|
|
UMask=0077
|
|
|
|
# Consider locking down all areas of /etc which hold machine identity keys, etc
|
|
InaccessiblePaths=/etc/ssh
|
|
|
|
# If you have systemd >= 247
|
|
ProtectProc=invisible
|
|
|
|
# If you have systemd >= 248
|
|
PrivateIPC=true
|
|
|
|
# Optional: writable directory for JetStream.
|
|
# See also: Unit.ConditionPathIsMountPoint
|
|
ReadWritePaths=/var/lib/nats
|
|
|
|
# Optional: resource control.
|
|
# Replace weights by values that make sense for your situation.
|
|
# For a list of all options see:
|
|
# https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html
|
|
#CPUAccounting=true
|
|
#CPUWeight=100 # of 10000
|
|
#IOAccounting=true
|
|
#IOWeight=100 # of 10000
|
|
#MemoryAccounting=true
|
|
#MemoryMax=1GB
|
|
#IPAccounting=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
# If you install this service as nats-server.service and want 'nats'
|
|
# to work as an alias, then uncomment this next line:
|
|
#Alias=nats.service
|