diff options
Diffstat (limited to 'straper/db/public/services/custom-units')
18 files changed, 402 insertions, 0 deletions
diff --git a/straper/db/public/services/custom-units/agate.service b/straper/db/public/services/custom-units/agate.service new file mode 100644 index 0000000..a8858b7 --- /dev/null +++ b/straper/db/public/services/custom-units/agate.service @@ -0,0 +1,15 @@ +[Unit] +Description=Agate Gemini Server +After=network.target + +[Service] +User=lukasz +WorkingDirectory=/srv/gemini-capsule +ExecStart=/home/lukasz/apps/agate/agate \ + --content /srv/gemini-capsule \ + --hostname gmi.labunix.xyz \ + --addr 0.0.0.0:1965 +Restart=on-failure + +[Install] +WantedBy=multi-user.target diff --git a/straper/db/public/services/custom-units/battery-limit.service b/straper/db/public/services/custom-units/battery-limit.service new file mode 100644 index 0000000..be72fd7 --- /dev/null +++ b/straper/db/public/services/custom-units/battery-limit.service @@ -0,0 +1,10 @@ +[Unit] +Description=Battery Charge Limit +After=multi-user.target + +[Service] +Type=oneshot +ExecStart=/bin/sh -c 'echo 55 > /sys/class/power_supply/BAT0/charge_control_end_threshold' + +[Install] +WantedBy=multi-user.target diff --git a/straper/db/public/services/custom-units/dbus-fi.w1.wpa_supplicant1.service b/straper/db/public/services/custom-units/dbus-fi.w1.wpa_supplicant1.service new file mode 100644 index 0000000..5f26b21 --- /dev/null +++ b/straper/db/public/services/custom-units/dbus-fi.w1.wpa_supplicant1.service @@ -0,0 +1,19 @@ +[Unit] +Description=WPA supplicant +Before=network.target +After=dbus.service +Wants=network.target +IgnoreOnIsolate=true + +[Service] +Type=dbus +BusName=fi.w1.wpa_supplicant1 +ExecStart=/usr/sbin/wpa_supplicant -u -s -O "DIR=/run/wpa_supplicant GROUP=netdev" +ExecReload=/bin/kill -HUP $MAINPID +Group=netdev +RuntimeDirectory=wpa_supplicant +RuntimeDirectoryMode=0750 + +[Install] +WantedBy=multi-user.target +Alias=dbus-fi.w1.wpa_supplicant1.service diff --git a/straper/db/public/services/custom-units/dbus-org.freedesktop.network1.service b/straper/db/public/services/custom-units/dbus-org.freedesktop.network1.service new file mode 100644 index 0000000..51d5f51 --- /dev/null +++ b/straper/db/public/services/custom-units/dbus-org.freedesktop.network1.service @@ -0,0 +1,69 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later +# +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Network Configuration +Documentation=man:systemd-networkd.service(8) +Documentation=man:org.freedesktop.network1(5) +ConditionCapability=CAP_NET_ADMIN +DefaultDependencies=no +# systemd-udevd.service can be dropped once tuntap is moved to netlink +After=systemd-networkd.socket systemd-udevd.service network-pre.target systemd-sysusers.service systemd-sysctl.service +Before=network.target multi-user.target shutdown.target initrd-switch-root.target +Conflicts=shutdown.target initrd-switch-root.target +Wants=systemd-networkd.socket network.target systemd-networkd-persistent-storage.service + +[Service] +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_BPF CAP_SYS_ADMIN +BusName=org.freedesktop.network1 +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_BPF CAP_SYS_ADMIN +DeviceAllow=char-* rw +ExecStart=!!/usr/lib/systemd/systemd-networkd +FileDescriptorStoreMax=512 +ImportCredential=network.wireguard.* +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes +ProtectProc=invisible +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectSystem=strict +Restart=on-failure +RestartKillSignal=SIGUSR2 +RestartSec=0 +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +RuntimeDirectory=systemd/netif +RuntimeDirectoryPreserve=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service bpf +Type=notify-reload +User=systemd-network +WatchdogSec=3min + +[Install] +WantedBy=multi-user.target +Also=systemd-networkd.socket +Alias=dbus-org.freedesktop.network1.service + +# The output from this generator is used by udevd and networkd. Enable it by +# default when enabling systemd-networkd.service. +Also=systemd-network-generator.service + +# We want to enable systemd-networkd-wait-online.service whenever this service +# is enabled. systemd-networkd-wait-online.service has +# WantedBy=network-online.target, so enabling it only has an effect if +# network-online.target itself is enabled or pulled in by some other unit. +Also=systemd-networkd-wait-online.service diff --git a/straper/db/public/services/custom-units/dbus-org.freedesktop.resolve1.service b/straper/db/public/services/custom-units/dbus-org.freedesktop.resolve1.service new file mode 100644 index 0000000..d100f70 --- /dev/null +++ b/straper/db/public/services/custom-units/dbus-org.freedesktop.resolve1.service @@ -0,0 +1,59 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later +# +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Network Name Resolution +Documentation=man:systemd-resolved.service(8) +Documentation=man:org.freedesktop.resolve1(5) +Documentation=https://systemd.io/WRITING_NETWORK_CONFIGURATION_MANAGERS +Documentation=https://systemd.io/WRITING_RESOLVER_CLIENTS + +DefaultDependencies=no +After=systemd-sysctl.service systemd-sysusers.service +Before=sysinit.target network.target nss-lookup.target shutdown.target initrd-switch-root.target +Conflicts=shutdown.target initrd-switch-root.target +Wants=nss-lookup.target + +[Service] +AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +BusName=org.freedesktop.resolve1 +CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +ExecStart=!!/usr/lib/systemd/systemd-resolved +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes +PrivateDevices=yes +PrivateTmp=disconnected +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict +Restart=always +RestartSec=0 +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +RuntimeDirectory=systemd/resolve +RuntimeDirectoryPreserve=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +Type=notify-reload +User=systemd-resolve +ImportCredential=network.dns +ImportCredential=network.search_domains +WatchdogSec=3min + +[Install] +WantedBy=sysinit.target +Alias=dbus-org.freedesktop.resolve1.service diff --git a/straper/db/public/services/custom-units/dbus-org.freedesktop.timesync1.service b/straper/db/public/services/custom-units/dbus-org.freedesktop.timesync1.service new file mode 100644 index 0000000..47445bc --- /dev/null +++ b/straper/db/public/services/custom-units/dbus-org.freedesktop.timesync1.service @@ -0,0 +1,60 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later +# +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Network Time Synchronization +Documentation=man:systemd-timesyncd.service(8) +ConditionCapability=CAP_SYS_TIME +ConditionVirtualization=!container +DefaultDependencies=no +After=systemd-sysusers.service +Before=time-set.target sysinit.target shutdown.target +Conflicts=shutdown.target +Wants=time-set.target + +[Service] +AmbientCapabilities=CAP_SYS_TIME +BusName=org.freedesktop.timesync1 +CapabilityBoundingSet=CAP_SYS_TIME +# Turn off DNSSEC validation for hostname look-ups, since those need the +# correct time to work, but we likely won't acquire that without NTP. Let's +# break this chicken-and-egg cycle here. +Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0 +ExecStart=!!/usr/lib/systemd/systemd-timesyncd +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes +PrivateDevices=yes +PrivateTmp=disconnected +ProtectProc=invisible +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=strict +Restart=always +RestartSec=0 +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +RuntimeDirectory=systemd/timesync +StateDirectory=systemd/timesync +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service @clock +Type=notify +User=systemd-timesync +WatchdogSec=3min + +[Install] +WantedBy=sysinit.target +Alias=dbus-org.freedesktop.timesync1.service diff --git a/straper/db/public/services/custom-units/dnsmasq.service b/straper/db/public/services/custom-units/dnsmasq.service new file mode 100644 index 0000000..a7be6d9 --- /dev/null +++ b/straper/db/public/services/custom-units/dnsmasq.service @@ -0,0 +1,18 @@ +[Unit] +Description=dnsmasq (local DNS forwarder) +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +ExecStart=/usr/sbin/dnsmasq -k \ + --no-resolv \ + --resolv-file=/dev/null \ + --server=127.0.0.1#5353 \ + --conf-file=/etc/dnsmasq.conf \ + --conf-dir=/etc/dnsmasq.d,*.conf +ExecReload=/bin/kill -HUP $MAINPID +Restart=on-failure + +[Install] +WantedBy=multi-user.target diff --git a/straper/db/public/services/custom-units/docker.service.d/override.conf b/straper/db/public/services/custom-units/docker.service.d/override.conf new file mode 100644 index 0000000..614a548 --- /dev/null +++ b/straper/db/public/services/custom-units/docker.service.d/override.conf @@ -0,0 +1,3 @@ +[Unit] +After=nftables.service +Wants=nftables.service diff --git a/straper/db/public/services/custom-units/loki.service b/straper/db/public/services/custom-units/loki.service new file mode 100644 index 0000000..2885fac --- /dev/null +++ b/straper/db/public/services/custom-units/loki.service @@ -0,0 +1,16 @@ +[Unit] +Description=Loki service +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +User=loki +ExecStart=/usr/bin/loki -config.file /etc/loki/config.yml +# Give a reasonable amount of time for the server to start up/shut down +TimeoutSec = 120 +Restart = on-failure +RestartSec = 2 + +[Install] +WantedBy=multi-user.target diff --git a/straper/db/public/services/custom-units/lufi.service b/straper/db/public/services/custom-units/lufi.service new file mode 100644 index 0000000..0d6c415 --- /dev/null +++ b/straper/db/public/services/custom-units/lufi.service @@ -0,0 +1,19 @@ +[Unit] +Description=Lufi (Mojolicious) +After=network.target + +[Service] +Type=forking +User=lufi +Group=lufi +WorkingDirectory=/srv/lufi +Environment=MOJO_MODE=production +ExecStart=/bin/bash -lc 'cd /srv/lufi && /usr/local/bin/carton exec hypnotoad script/lufi' +ExecStop=/bin/bash -lc 'cd /srv/lufi && /usr/local/bin/carton exec hypnotoad -s script/lufi' +PIDFile=/srv/lufi/hypnotoad.pid +Restart=on-failure +RestartSec=2 + +[Install] +WantedBy=multi-user.target + diff --git a/straper/db/public/services/custom-units/nftables.service.d/override.conf b/straper/db/public/services/custom-units/nftables.service.d/override.conf new file mode 100644 index 0000000..fa12217 --- /dev/null +++ b/straper/db/public/services/custom-units/nftables.service.d/override.conf @@ -0,0 +1,2 @@ +[Unit] +After=docker.service diff --git a/straper/db/public/services/custom-units/paperless.service b/straper/db/public/services/custom-units/paperless.service new file mode 100644 index 0000000..c95bc63 --- /dev/null +++ b/straper/db/public/services/custom-units/paperless.service @@ -0,0 +1,28 @@ +[Unit] +Description=Paperless-ngx +Requires=docker.service +Wants=network-online.target +After=docker.service network-online.target + +[Service] +Type=oneshot +RemainAfterExit=yes +WorkingDirectory=/srv/paperless + +# Wait until Docker actually answers +ExecStartPre=/usr/bin/docker info + +# Retry startup in case of transient dbus / cgroup failure +ExecStart=/bin/sh -c 'for i in 1 2 3 4 5; do /usr/bin/docker compose up -d && exit 0; sleep 10; done; exit 1' + +ExecStop=/usr/bin/docker compose down + +Restart=on-failure +RestartSec=10 +StartLimitIntervalSec=0 + +TimeoutStartSec=0 + +[Install] +WantedBy=multi-user.target + diff --git a/straper/db/public/services/custom-units/promtail.service b/straper/db/public/services/custom-units/promtail.service new file mode 100644 index 0000000..258e40a --- /dev/null +++ b/straper/db/public/services/custom-units/promtail.service @@ -0,0 +1,16 @@ +[Unit] +Description=Promtail service +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +User=promtail +ExecStart=/usr/bin/promtail -config.file /etc/promtail/config.yml +# Give a reasonable amount of time for promtail to start up/shut down +TimeoutSec = 60 +Restart = on-failure +RestartSec = 2 + +[Install] +WantedBy=multi-user.target diff --git a/straper/db/public/services/custom-units/smartd.service b/straper/db/public/services/custom-units/smartd.service new file mode 100644 index 0000000..f2f175c --- /dev/null +++ b/straper/db/public/services/custom-units/smartd.service @@ -0,0 +1,17 @@ +[Unit] +Description=Self Monitoring and Reporting Technology (SMART) Daemon +Documentation=man:smartd(8) man:smartd.conf(5) + +# Typically physical storage devices are managed by the host physical machine +# Override it if you are using PCI/USB passthrough +ConditionVirtualization=no + +[Service] +Type=notify +EnvironmentFile=-/etc/default/smartmontools +ExecStart=/usr/sbin/smartd -n $smartd_opts +ExecReload=/bin/kill -HUP $MAINPID + +[Install] +WantedBy=multi-user.target +Alias=smartd.service diff --git a/straper/db/public/services/custom-units/speedtest-exporter.service b/straper/db/public/services/custom-units/speedtest-exporter.service new file mode 100644 index 0000000..275b8e2 --- /dev/null +++ b/straper/db/public/services/custom-units/speedtest-exporter.service @@ -0,0 +1,13 @@ +[Unit] +Description=Prometheus Speedtest Exporter +After=network.target + +[Service] +Type=simple +User=lukasz +ExecStart=/usr/bin/python3 -m prometheus_speedtest.prometheus_speedtest +Environment=PYTHONPATH=/home/lukasz/.local/lib/python3.13/site-packages +Restart=on-failure + +[Install] +WantedBy=multi-user.target diff --git a/straper/db/public/services/custom-units/sshd.service b/straper/db/public/services/custom-units/sshd.service new file mode 100644 index 0000000..0eb0d67 --- /dev/null +++ b/straper/db/public/services/custom-units/sshd.service @@ -0,0 +1,22 @@ +[Unit] +Description=OpenBSD Secure Shell server +Documentation=man:sshd(8) man:sshd_config(5) +After=network.target nss-user-lookup.target auditd.service +ConditionPathExists=!/etc/ssh/sshd_not_to_be_run + +[Service] +EnvironmentFile=-/etc/default/ssh +ExecStartPre=/usr/sbin/sshd -t +ExecStart=/usr/sbin/sshd -D $SSHD_OPTS +ExecReload=/usr/sbin/sshd -t +ExecReload=/bin/kill -HUP $MAINPID +KillMode=process +Restart=on-failure +RestartPreventExitStatus=255 +Type=notify +RuntimeDirectory=sshd +RuntimeDirectoryMode=0755 + +[Install] +WantedBy=multi-user.target +Alias=sshd.service diff --git a/straper/db/public/services/custom-units/zed.service b/straper/db/public/services/custom-units/zed.service new file mode 100644 index 0000000..acc1230 --- /dev/null +++ b/straper/db/public/services/custom-units/zed.service @@ -0,0 +1,13 @@ +[Unit] +Description=ZFS Event Daemon (zed) +Documentation=man:zed(8) +ConditionPathIsDirectory=/sys/module/zfs + +[Service] +EnvironmentFile=-/etc/default/zfs +ExecStart=/usr/sbin/zed -F +Restart=always + +[Install] +Alias=zed.service +WantedBy=zfs.target diff --git a/straper/db/public/services/custom-units/zfs-import-scan.service.d/override.conf b/straper/db/public/services/custom-units/zfs-import-scan.service.d/override.conf new file mode 100644 index 0000000..83069c5 --- /dev/null +++ b/straper/db/public/services/custom-units/zfs-import-scan.service.d/override.conf @@ -0,0 +1,3 @@ +[Unit] +After=cryptsetup.target lvm2-monitor.service +Requires=cryptsetup.target lvm2-monitor.service |