46 lines
1.5 KiB
SYSTEMD
Executable File
46 lines
1.5 KiB
SYSTEMD
Executable File
# Sorcery-Go Package Management Engine — systemd unit
|
|
# File: /etc/systemd/system/sorcery-go.service
|
|
#
|
|
# Install with:
|
|
# sudo cp sorcery-go.service /etc/systemd/system/
|
|
# sudo systemctl daemon-reload
|
|
# sudo systemctl enable --now sorcery-go
|
|
#
|
|
# Security is enforced by eBPF LSM programs (Tomb Guard + cgroup filters).
|
|
# No AppArmor profile is needed — the eBPF programs handle MAC at kernel level.
|
|
|
|
[Unit]
|
|
Description=Sorcery-Go Sovereign Coven Engine (eBPF-enforced)
|
|
Documentation=https://git.dcos.net/dcosnet/sorcery-go
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
ConditionPathExists=/var/lib/sorcery-go/state/state.db
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/local/sbin/sorcery-go web --port 8080 --cockpit-integration
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Capabilities required for OverlayFS, chown, DAC override, and eBPF program loading.
|
|
AmbientCapabilities=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_BPF
|
|
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_BPF
|
|
|
|
# Security hardening (eBPF LSM provides MAC — AppArmor/SELinux not required)
|
|
PrivateTmp=yes
|
|
ProtectSystem=full
|
|
ProtectHome=yes
|
|
NoNewPrivileges=yes
|
|
ReadWritePaths=/var/lib/sorcery-go /var/spool/sorcery-go /var/lib/sorcery-go/ebpf/maps
|
|
|
|
# Environment
|
|
Environment=SORCERY_GO_ROOT=/var/lib/sorcery-go
|
|
Environment=SORCERY_GO_RUNTIME=auto
|
|
Environment=SORCERY_GO_EBPF_ENFORCE=true
|
|
|
|
# Resource limits (builds can be heavy)
|
|
LimitNOFILE=65536
|
|
TasksMax=infinity
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target |