27 lines
613 B
Desktop File
27 lines
613 B
Desktop File
# /etc/systemd/system/pn.service
|
||
[Unit]
|
||
Description=Pure Note - minimalist high-security private notes + blog
|
||
After=network.target
|
||
|
||
[Service]
|
||
User=purenote
|
||
WorkingDirectory=/opt/pure-note
|
||
ExecStart=/opt/pure-note/pn start --addr 127.0.0.1:8080 \
|
||
--data-dir /opt/pure-note/data --behind-proxy
|
||
Restart=on-failure
|
||
RestartSec=5
|
||
|
||
# 沙箱加固（§10.2）
|
||
NoNewPrivileges=true
|
||
PrivateTmp=true
|
||
ProtectSystem=strict
|
||
ProtectHome=true
|
||
ReadWritePaths=/opt/pure-note/data
|
||
MemoryDenyWriteExecute=true
|
||
ProtectKernelTunables=true
|
||
ProtectControlGroups=true
|
||
RestrictSUIDSGID=true
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|