1
0
mirror of https://github.com/ArcticFoxes-net/Synapse-Ubuntu-ZFS synced 2024-11-18 00:21:32 -05:00
Synapse-Ubuntu-ZFS/etc/systemd/system/certbot-ocsp-fetcher.service

58 lines
1.2 KiB
SYSTEMD
Raw Normal View History

2023-08-25 16:17:37 -04:00
[Unit]
Description=Fetch OCSP responses for all certificates issued with Certbot
2023-08-25 16:17:37 -04:00
[Service]
Type=oneshot
Restart=on-failure
CacheDirectory=%N
2023-08-25 16:17:37 -04:00
User=root
Group=root
ExecStart=%N --no-reload-webserver -o /var/cache/certbot-ocsp-fetcher
ExecStartPost=systemctl reload nginx.service
RestartSec=5
PrivateDevices=true
PrivateTmp=yes
PrivateUsers=yes
PrivateIPC=true
NoNewPrivileges=true
LockPersonality=true
CapabilityBoundingSet=
ProtectHome=yes
ProtectControlGroups=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectClock=true
ProtectProc=invisible
ProcSubset=pid
ProtectHostname=true
RemoveIPC=true
RestrictAddressFamilies=AF_INET6 AF_INET AF_UNIX
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictNamespaces=true
RestrictSUIDSGID=true
DevicePolicy=strict
DeviceAllow=/dev/random r
DeviceAllow=/dev/urandom r
DeviceAllow=/dev/stdin r
DeviceAllow=/dev/stdout r
DeviceAllow=/dev/null w
ProtectSystem=strict
InaccessiblePaths=/root/
ReadOnlyPaths=/etc/letsencrypt
UMask=0077
2023-08-25 16:17:37 -04:00
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@clock @debug @module @mount @reboot @swap @resources @cpu-emulation @raw-io @obsolete @keyring @privileged