mirror of
https://github.com/shadowsocks/shadowsocks-rust.git
synced 2026-11-06 08:14:07 +00:00
Klaaktu
e33daa7114
* systemd: Use network-online.target for server Fixes #2186 ss-server needs to wait for the network to be up to be able to bind to non-wildcard IPs. Interface is configured at `network-online.target` but not at `network.target`. ss-local unit is kept the same, with `After=network.target` for proper ordering at shutdown - unit is stopped before network is shutdown. * systemd unit: improvements `exec` is [recommended](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Type=). Add `NoNewPriviledges` which has been used in [Arch packaging](https://gitlab.archlinux.org/archlinux/packaging/packages/shadowsocks-rust/-/blob/main/shadowsocks-rust-server%40.service?ref_type=heads). Add `CAP_NET_ADMIN` in ss-local which is needed for TUN mode. Removed `CAP_NET_BIND_SERVICE` from ss-local. Do you really need to bind to priviledged port in *client*? Debian unit left un-hardened. I'm not sure why it's different from the other ss-server unit.
22 lines
607 B
Desktop File
22 lines
607 B
Desktop File
# This file is part of shadowsocks-rust.
|
|
#
|
|
# This is a template unit file. Users may copy and rename the file into
|
|
# config directories to make new service instances. See systemd.unit(5)
|
|
# for details.
|
|
|
|
[Unit]
|
|
Description=Shadowsocks-rust Custom Client Service for %I
|
|
Documentation=https://github.com/shadowsocks/shadowsocks-rust
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
CapabilityBoundingSet=CAP_NET_ADMIN
|
|
AmbientCapabilities=CAP_NET_ADMIN
|
|
NoNewPrivileges=yes
|
|
DynamicUser=yes
|
|
ExecStart=/usr/bin/ssservice local --log-without-time -c /etc/shadowsocks-rust/%i.json
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|