lbrycrd/contrib/init/bitcoind.service

# It is not recommended to modify this file in-place, because it will
# be overwritten during package upgrades. If you want to add further
# options or overwrite existing ones then use
# $ systemctl edit bitcoind.service
# See "man systemd.service" for details.

# Note that almost all daemon options could be specified in
# /etc/bitcoin/bitcoin.conf, except for those explicitly specified as arguments
# in ExecStart=

[Unit]
Description=Bitcoin daemon
After=network.target

[Service]
ExecStart=/usr/bin/bitcoind -daemon \
                            -pid=/run/bitcoind/bitcoind.pid \
                            -conf=/etc/bitcoin/bitcoin.conf \
                            -datadir=/var/lib/bitcoind

# Process management
####################

Type=forking
PIDFile=/run/bitcoind/bitcoind.pid
Restart=on-failure

# Directory creation and permissions
####################################

# Run as bitcoin:bitcoin
User=bitcoin
Group=bitcoin

# /run/bitcoind
RuntimeDirectory=bitcoind
RuntimeDirectoryMode=0710

# /etc/bitcoin
ConfigurationDirectory=bitcoin
ConfigurationDirectoryMode=0710

# /var/lib/bitcoind
StateDirectory=bitcoind
StateDirectoryMode=0710

# Hardening measures
####################

# Provide a private /tmp and /var/tmp.
PrivateTmp=true

# Mount /usr, /boot/ and /etc read-only for the process.
ProtectSystem=full

# Disallow the process and all of its children to gain
# new privileges through execve().
NoNewPrivileges=true

# Use a new /dev namespace only populated with API pseudo devices
# such as /dev/null, /dev/zero and /dev/random.
PrivateDevices=true

# Deny the creation of writable and executable memory mappings.
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually). 2017-06-05 10:38:42 +02:00			`# It is not recommended to modify this file in-place, because it will`
			`# be overwritten during package upgrades. If you want to add further`
			`# options or overwrite existing ones then use`
			`# $ systemctl edit bitcoind.service`
			`# See "man systemd.service" for details.`

			`# Note that almost all daemon options could be specified in`
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory. 2019-01-03 14:53:51 +01:00			`# /etc/bitcoin/bitcoin.conf, except for those explicitly specified as arguments`
			`# in ExecStart=`
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually). 2017-06-05 10:38:42 +02:00
Added systemd .service file in order to help distributions integrate bitcoind. 2014-07-23 20:10:01 +02:00			`[Unit]`
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually). 2017-06-05 10:38:42 +02:00			`Description=Bitcoin daemon`
Added systemd .service file in order to help distributions integrate bitcoind. 2014-07-23 20:10:01 +02:00			`After=network.target`

			`[Service]`
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory. 2019-01-03 14:53:51 +01:00			`ExecStart=/usr/bin/bitcoind -daemon \`
			`-pid=/run/bitcoind/bitcoind.pid \`
			`-conf=/etc/bitcoin/bitcoin.conf \`
			`-datadir=/var/lib/bitcoind`

			`# Process management`
			`####################`

Added systemd .service file in order to help distributions integrate bitcoind. 2014-07-23 20:10:01 +02:00			`Type=forking`
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually). 2017-06-05 10:38:42 +02:00			`PIDFile=/run/bitcoind/bitcoind.pid`
			`Restart=on-failure`
Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services. 2018-01-06 18:56:13 +01:00
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory. 2019-01-03 14:53:51 +01:00			`# Directory creation and permissions`
			`####################################`

			`# Run as bitcoin:bitcoin`
			`User=bitcoin`
			`Group=bitcoin`

			`# /run/bitcoind`
			`RuntimeDirectory=bitcoind`
			`RuntimeDirectoryMode=0710`

			`# /etc/bitcoin`
			`ConfigurationDirectory=bitcoin`
			`ConfigurationDirectoryMode=0710`

			`# /var/lib/bitcoind`
			`StateDirectory=bitcoind`
			`StateDirectoryMode=0710`

Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services. 2018-01-06 18:56:13 +01:00			`# Hardening measures`
			`####################`

			`# Provide a private /tmp and /var/tmp.`
Added systemd .service file in order to help distributions integrate bitcoind. 2014-07-23 20:10:01 +02:00			`PrivateTmp=true`

Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services. 2018-01-06 18:56:13 +01:00			`# Mount /usr, /boot/ and /etc read-only for the process.`
			`ProtectSystem=full`

			`# Disallow the process and all of its children to gain`
			`# new privileges through execve().`
			`NoNewPrivileges=true`

			`# Use a new /dev namespace only populated with API pseudo devices`
			`# such as /dev/null, /dev/zero and /dev/random.`
			`PrivateDevices=true`

			`# Deny the creation of writable and executable memory mappings.`
			`MemoryDenyWriteExecute=true`

Added systemd .service file in order to help distributions integrate bitcoind. 2014-07-23 20:10:01 +02:00			`[Install]`
			`WantedBy=multi-user.target`