aboutsummaryrefslogtreecommitdiffhomepage
path: root/support
diff options
context:
space:
mode:
Diffstat (limited to 'support')
-rw-r--r--support/systemd/peertube.service14
1 files changed, 14 insertions, 0 deletions
diff --git a/support/systemd/peertube.service b/support/systemd/peertube.service
index 88856385c..c1bdcf760 100644
--- a/support/systemd/peertube.service
+++ b/support/systemd/peertube.service
@@ -15,5 +15,19 @@ StandardError=syslog
15SyslogIdentifier=peertube 15SyslogIdentifier=peertube
16Restart=always 16Restart=always
17 17
18; Some security directives.
19; Use private /tmp and /var/tmp folders inside a new file system namespace,
20; which are discarded after the process stops.
21PrivateTmp=true
22; Mount /usr, /boot, and /etc as read-only for processes invoked by this service.
23ProtectSystem=full
24; Sets up a new /dev mount for the process and only adds API pseudo devices
25; like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled
26; by default because it may not work on devices like the Raspberry Pi.
27PrivateDevices=false
28; Ensures that the service process and all its children can never gain new
29; privileges through execve().
30NoNewPrivileges=true
31
18[Install] 32[Install]
19WantedBy=multi-user.target 33WantedBy=multi-user.target