rustforge
RustForge: the read-only, cgit-style git web host serving this site
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 | # systemd unit for RustForge. Install to /etc/systemd/system/rustforge.service, then: # sudo systemctl daemon-reload && sudo systemctl enable --now rustforge [Unit] Description=RustForge - read-only cgit-style git web host Documentation=file:///opt/rustforge/README.md After=network-online.target Wants=network-online.target [Service] Type=simple User=rustforge Group=rustforge ExecStart=/opt/rustforge/bin/rustforge /etc/rustforge/rustforge.toml WorkingDirectory=/srv/git Environment=HOME=/srv/git Restart=on-failure RestartSec=2s # --- hardening ------------------------------------------------------------- # RustForge only *reads* repos (git upload-pack never writes), so the whole # filesystem is read-only to it; /tmp is a private, empty tmpfs. NoNewPrivileges=true ProtectSystem=strict ReadOnlyPaths=/srv/git /etc/rustforge /opt/rustforge ProtectHome=true PrivateTmp=true PrivateDevices=true ProtectKernelTunables=true ProtectKernelModules=true ProtectKernelLogs=true ProtectControlGroups=true ProtectClock=true ProtectHostname=true RestrictSUIDSGID=true RestrictRealtime=true RestrictNamespaces=true LockPersonality=true RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX CapabilityBoundingSet= AmbientCapabilities= UMask=0077 [Install] WantedBy=multi-user.target |