caddy/dist/init/linux-systemd/caddy.service

[Unit]
Description=Caddy HTTP/2 web server
Documentation=https://caddyserver.com/docs
After=network-online.target
Wants=network-online.target systemd-networkd-wait-online.service

[Service]
Restart=on-failure

; User and group the process will run as.
User=www-data
Group=www-data

; Letsencrypt-issued certificates will be written to this directory.
Environment=CADDYPATH=/etc/ssl/caddy

; Always set "-root" to something safe in case it gets forgotten in the Caddyfile.
ExecStart=/usr/local/bin/caddy -log stdout -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp
ExecReload=/bin/kill -USR1 $MAINPID

; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
LimitNOFILE=1048576
; Unmodified caddy is not expected to use more than that.
LimitNPROC=64

; Use private /tmp and /var/tmp, which are discarded after caddy stops.
PrivateTmp=true
; Use a minimal /dev
PrivateDevices=true
; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
ProtectHome=true
; Make /usr, /boot, /etc and possibly some more folders read-only.
ProtectSystem=full
; … except /etc/ssl/caddy, because we want Letsencrypt-certificates there.
;   This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
ReadWriteDirectories=/etc/ssl/caddy

; The following additional security directives only work with systemd v229 or later.
; They further retrict privileges that can be gained by caddy. Uncomment if you like.
; Note that you may have to add capabilities required by any plugins in use.
;CapabilityBoundingSet=CAP_NET_BIND_SERVICE
;AmbientCapabilities=CAP_NET_BIND_SERVICE
;NoNewPrivileges=true

[Install]
WantedBy=multi-user.target
systemd: Run caddy with even less privileges and more confined The exemplary unit file for systemd is intentionally redundant at times, for example dropping privileges which an unprivileged user "www-data" did not have in the first place: To aid as fallback in case the file gets copied and an operator setting UID to 0 (which reportedly happened in the past). 2016-05-11 13:48:47 -05:00			`[Unit]`
			`Description=Caddy HTTP/2 web server`
			`Documentation=https://caddyserver.com/docs`
			`After=network-online.target`
			`Wants=network-online.target systemd-networkd-wait-online.service`

			`[Service]`
			`Restart=on-failure`

			`; User and group the process will run as.`
			`User=www-data`
			`Group=www-data`

			`; Letsencrypt-issued certificates will be written to this directory.`
Init switch from HOME to Caddy (#1272) * INIT-systemd use CADDYPATH instatt of HOME * INIT-upstart use CADDYPATH instatt of HOME * INIT-upstart use CADDYPATH instatt of HOME * INIT-upstart use CADDYPATH instatt of HOME 2016-11-23 16:12:19 -05:00			`Environment=CADDYPATH=/etc/ssl/caddy`
systemd: Run caddy with even less privileges and more confined The exemplary unit file for systemd is intentionally redundant at times, for example dropping privileges which an unprivileged user "www-data" did not have in the first place: To aid as fallback in case the file gets copied and an operator setting UID to 0 (which reportedly happened in the past). 2016-05-11 13:48:47 -05:00
			`; Always set "-root" to something safe in case it gets forgotten in the Caddyfile.`
Changing refs from /usr/bin to /usr/local/bin 2016-07-05 12:39:04 -05:00			`ExecStart=/usr/local/bin/caddy -log stdout -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp`
systemd: Run caddy with even less privileges and more confined The exemplary unit file for systemd is intentionally redundant at times, for example dropping privileges which an unprivileged user "www-data" did not have in the first place: To aid as fallback in case the file gets copied and an operator setting UID to 0 (which reportedly happened in the past). 2016-05-11 13:48:47 -05:00			`ExecReload=/bin/kill -USR1 $MAINPID`

			; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
			`LimitNOFILE=1048576`
			`; Unmodified caddy is not expected to use more than that.`
			`LimitNPROC=64`

			`; Use private /tmp and /var/tmp, which are discarded after caddy stops.`
			`PrivateTmp=true`
			`; Use a minimal /dev`
			`PrivateDevices=true`
			`; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.`
			`ProtectHome=true`
			`; Make /usr, /boot, /etc and possibly some more folders read-only.`
			`ProtectSystem=full`
			`; … except /etc/ssl/caddy, because we want Letsencrypt-certificates there.`
			`; This merely retains r/w access rights, it does not add any new. Must still be writable on the host!`
			`ReadWriteDirectories=/etc/ssl/caddy`

improvements for Linux systemd integration (#1127) * Remove unnecessary config options from systemd service so it will work with earlier versions of systemd. Simplify the systemd service instructions and make them more complete. * Minor systemd README improvements. * Add back some of the optional systemd 229 stuff but commented out for compat. * A bunch of updates to the README for linux systemd. 2016-09-23 17:50:39 -05:00			`; The following additional security directives only work with systemd v229 or later.`
			`; They further retrict privileges that can be gained by caddy. Uncomment if you like.`
			`; Note that you may have to add capabilities required by any plugins in use.`
			`;CapabilityBoundingSet=CAP_NET_BIND_SERVICE`
			`;AmbientCapabilities=CAP_NET_BIND_SERVICE`
			`;NoNewPrivileges=true`
systemd: Run caddy with even less privileges and more confined The exemplary unit file for systemd is intentionally redundant at times, for example dropping privileges which an unprivileged user "www-data" did not have in the first place: To aid as fallback in case the file gets copied and an operator setting UID to 0 (which reportedly happened in the past). 2016-05-11 13:48:47 -05:00
			`[Install]`
			`WantedBy=multi-user.target`