Tahinli/forge
public0 watching
★ 0
| 1 | [Unit] |
| 2 | Description=forge self-hosted git forge |
| 3 | After=network-online.target |
| 4 | Wants=network-online.target |
| 5 | StartLimitIntervalSec=60 |
| 6 | StartLimitBurst=5 |
| 7 | |
| 8 | [Service] |
| 9 | Type=simple |
| 10 | User=forge |
| 11 | Group=forge |
| 12 | Environment=FORGE_CONFIG=/etc/forge/forge.toml |
| 13 | ExecStart=/usr/local/bin/forge serve |
| 14 | WorkingDirectory=/var/lib/forge |
| 15 | Restart=on-failure |
| 16 | RestartSec=2 |
| 17 | LimitNOFILE=65536 |
| 18 | |
| 19 | # Hardening |
| 20 | NoNewPrivileges=yes |
| 21 | ProtectSystem=strict |
| 22 | ProtectHome=yes |
| 23 | # backups dir is optional, keep in sync with `[backup] dir` |
| 24 | ReadWritePaths=/var/lib/forge -/var/backups/forge |
| 25 | PrivateTmp=yes |
| 26 | PrivateDevices=yes |
| 27 | ProtectKernelTunables=yes |
| 28 | ProtectKernelModules=yes |
| 29 | ProtectKernelLogs=yes |
| 30 | ProtectControlGroups=yes |
| 31 | ProtectClock=yes |
| 32 | ProtectHostname=yes |
| 33 | RestrictSUIDSGID=yes |
| 34 | RestrictRealtime=yes |
| 35 | RestrictNamespaces=yes |
| 36 | LockPersonality=yes |
| 37 | SystemCallArchitectures=native |
| 38 | CapabilityBoundingSet= |
| 39 | AmbientCapabilities= |
| 40 | UMask=0077 |
| 41 | |
| 42 | [Install] |
| 43 | WantedBy=multi-user.target |