36 lines
1.2 KiB
Text
36 lines
1.2 KiB
Text
|
# Managed by Ansible — do not edit by hand.
|
||
|
|
# veza_app role, templates/veza-stream.service.j2.
|
||
|
|
# Released SHA: {{ veza_release_sha }} ; color: {{ veza_target_color }}
|
||
|
|
[Unit]
|
||
|
|
Description=Veza stream server (Rust/Axum) — color {{ veza_target_color }}, sha {{ veza_release_sha[:12] }}
|
||
|
|
Documentation=https://veza.fr/docs
|
||
|
|
After=network-online.target
|
||
|
|
Wants=network-online.target
|
||
|
|
AssertPathExists={{ veza_app_current_link }}/{{ veza_app_binary_name }}
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
Type=simple
|
||
|
|
User={{ veza_app_user }}
|
||
|
|
Group={{ veza_app_group }}
|
||
|
|
EnvironmentFile=-{{ veza_app_env_file }}
|
||
|
|
WorkingDirectory={{ veza_app_current_link }}
|
||
|
|
ExecStart={{ veza_app_current_link }}/{{ veza_app_binary_name }}
|
||
|
|
Restart=on-failure
|
||
|
|
RestartSec=5s
|
||
|
|
# Stream server holds many WebSocket + HLS connections in flight ;
|
||
|
|
# the default LimitNOFILE=1024 chokes around 200 concurrent listeners.
|
||
|
|
LimitNOFILE=131072
|
||
|
|
|
||
|
|
# Hardening — same baseline as the backend.
|
||
|
|
NoNewPrivileges=true
|
||
|
|
ProtectSystem=strict
|
||
|
|
ProtectHome=true
|
||
|
|
ReadWritePaths={{ veza_app_install_dir }} {{ veza_log_root }} {{ veza_state_root }}
|
||
|
|
PrivateTmp=true
|
||
|
|
ProtectKernelTunables=true
|
||
|
|
ProtectKernelModules=true
|
||
|
|
ProtectControlGroups=true
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=multi-user.target
|