ympd/contrib/ympd.service

[Unit]
Description=ympd server daemon
Requires=network.target local-fs.target

[Service]
User=nobody
DynamicUser=yes
MountAPIVFS=yes
RemoveIPC=yes
CapabilityBoundingSet=
LockPersonality=yes
PrivateUsers=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
NoNewPrivileges=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictNamespaces=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectHome=yes

Environment=MPD_HOST=localhost
Environment=MPD_PORT=6600
Environment=MPD_PASSWORD=
Environment=WEB_PORT=8080
Environment=YMPD_USER=nobody
Environment=DIRBLE_API_TOKEN=2e223c9909593b94fc6577361a
Environment=DIGEST=
Environment=LOCALPORT=
EnvironmentFile=/etc/default/ympd
ExecStart=/usr/bin/ympd --user $USER --webport $WEB_PORT --host $MPD_HOST --port $MPD_PORT --dirbletoken $DIRBLE_API_TOKEN $DIGEST $LOCALPORT
Type=simple

[Install]
WantedBy=multi-user.target
add systemd service file 2014-01-21 16:01:24 -05:00			`[Unit]`
			`Description=ympd server daemon`
			`Requires=network.target local-fs.target`

			`[Service]`
moved definition of default user to service file 2019-04-22 11:47:22 +02:00			`User=nobody`
Harden ympd.service This offers a measure of protection against potential ympd vulnerabilities. See https://www.freedesktop.org/software/systemd/man/systemd.exec.html for documentation. 2019-03-10 16:43:39 +00:00			`DynamicUser=yes`
			`MountAPIVFS=yes`
			`RemoveIPC=yes`
			`CapabilityBoundingSet=`
			`LockPersonality=yes`
			`PrivateUsers=yes`
			`PrivateTmp=yes`
			`PrivateDevices=yes`
			`ProtectSystem=strict`
			`NoNewPrivileges=yes`
			`MemoryDenyWriteExecute=yes`
			`RestrictRealtime=yes`
			`RestrictNamespaces=yes`
			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6`
			`ProtectKernelTunables=yes`
			`ProtectKernelModules=yes`
			`ProtectControlGroups=yes`
			`ProtectHome=yes`

Allow the sytemd unit to read a configuration file 2014-04-12 19:45:40 +02:00			`Environment=MPD_HOST=localhost`
			`Environment=MPD_PORT=6600`
config for system services 2017-02-18 12:00:28 -05:00			`Environment=MPD_PASSWORD=`
Allow the sytemd unit to read a configuration file 2014-04-12 19:45:40 +02:00			`Environment=WEB_PORT=8080`
update init script and systemd service file init script: depend on $remote_fs instead of $local_fs. Reason: /usr can be mounted a remote filesystem. Also depend on mpd (instead of $mpd, which doesn't seem to exist.. at least on my system) Also provide a default config (which should be installed as /etc/default/ympd) This commit makes the systemd unit file as well as the init script load values from this configuration file so the user can change ympd settings easily when running it as a service. 2015-05-01 17:11:15 -04:00			`Environment=YMPD_USER=nobody`
Make the Dirble API token configurable and use HTTPS Fixes #140 2016-09-11 17:54:25 +02:00			`Environment=DIRBLE_API_TOKEN=2e223c9909593b94fc6577361a`
add digest option to contrib files 2015-11-13 15:07:07 +01:00			`Environment=DIGEST=`
add option "localport" to exclude ports from auth usefull if ympd listens on two ports: one (local) for intranet usage and one for internet usage 2018-03-25 13:45:16 +02:00			`Environment=LOCALPORT=`
update init script and systemd service file init script: depend on $remote_fs instead of $local_fs. Reason: /usr can be mounted a remote filesystem. Also depend on mpd (instead of $mpd, which doesn't seem to exist.. at least on my system) Also provide a default config (which should be installed as /etc/default/ympd) This commit makes the systemd unit file as well as the init script load values from this configuration file so the user can change ympd settings easily when running it as a service. 2015-05-01 17:11:15 -04:00			`EnvironmentFile=/etc/default/ympd`
Merge branch 'master' into harden 2019-04-22 11:53:24 +02:00			`ExecStart=/usr/bin/ympd --user $USER --webport $WEB_PORT --host $MPD_HOST --port $MPD_PORT --dirbletoken $DIRBLE_API_TOKEN $DIGEST $LOCALPORT`
add systemd service file 2014-01-21 16:01:24 -05:00			`Type=simple`

			`[Install]`
			`WantedBy=multi-user.target`