vsTaskViewer/vsTaskViewer.service at main · osi8/vsTaskViewer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
[Unit]
Description=vsTaskViewer - Task execution viewer with WebSocket support
Documentation=https://github.com/osi8/vsTaskViewer
After=network-online.target
Wants=network-online.target
Requires=network-online.target

[Service]
Type=simple
User=root
Group=root
# Start as root to read TLS/HTML files, then drop to www-data
# The application handles privilege dropping internally

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
# Allow writing to task directory
ReadWritePaths=/var/vsTaskViewer
# Allow reading from /etc/vsTaskViewer (config and HTML files) and TLS certificates
ReadOnlyPaths=/etc/vsTaskViewer /etc/ssl /etc/letsencrypt

# Restrict namespaces (prevent creating new namespaces)
RestrictNamespaces=true

# Restrict realtime scheduling
RestrictRealtime=true

# Restrict SUID/SGID binaries
RestrictSUIDSGID=true

# Prevent memory from being writable and executable at the same time
MemoryDenyWriteExecute=true

# Lock personality (prevent switching to different execution domains)
LockPersonality=true

# Protect kernel tunables and modules
ProtectKernelTunables=true
ProtectKernelModules=true

# Protect control groups
ProtectControlGroups=true

# Restrict address families (only IPv4 and IPv6)
RestrictAddressFamilies=AF_INET AF_INET6

# Remove all capabilities except those needed
# NET_BIND_SERVICE needed to bind to ports < 1024
# CHOWN needed for task directory creation
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_CHOWN
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN

# Limit resources
LimitNOFILE=65536
LimitNPROC=4096

# Working directory
WorkingDirectory=/var/vsTaskViewer

# Executable
ExecStart=/usr/local/bin/vsTaskViewer \
    -c /etc/vsTaskViewer/vsTaskViewer.toml \
    -t /etc/vsTaskViewer/html \
    -d /var/vsTaskViewer \
    -u www-data

# Restart policy
Restart=on-failure
RestartSec=5s
StartLimitInterval=300
StartLimitBurst=5

# Timeouts
TimeoutStartSec=30
TimeoutStopSec=30

# Kill mode
KillMode=mixed
KillSignal=SIGTERM

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=vsTaskViewer

# Environment
Environment="PATH=/usr/local/bin:/usr/bin:/bin"

[Install]
WantedBy=multi-user.target