mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
CyberMind-FR
2ec7cef1b2
secubox-core.service is a Type=oneshot (mkdir+chown) that RemainAfterExit=yes. A hard Requires= on ~108 units cascade-stops them all if core is restarted/fails (e.g. a secubox-core package upgrade) — a thundering-herd outage. After= keeps the ordering; Wants= keeps the soft dependency without the cascade. Prereq for mass native apply (Phase 3). Scaffolds (new-module.sh/new-package.sh) updated so future units use Wants=. Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
37 lines
1.1 KiB
Desktop File
37 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=SecuBox FM Relay — host control plane API (issue #377)
|
|
Documentation=https://github.com/CyberMind-FR/secubox-deb/issues/377
|
|
After=network.target
|
|
Wants=secubox-core.service
|
|
# Soft dep: icecast2 must be up before any /start call can succeed,
|
|
# but the API itself runs without it (it'll report `red` overall).
|
|
Wants=icecast2.service
|
|
After=icecast2.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=secubox
|
|
Group=secubox
|
|
RuntimeDirectory=secubox
|
|
RuntimeDirectoryMode=0755
|
|
# MUST preserve /run/secubox across unit restarts — otherwise stopping
|
|
# this service wipes the directory and removes every other secubox
|
|
# module's socket (lyrion, authelia, etc.). Same pattern as every other
|
|
# secubox unit that owns RuntimeDirectory=secubox.
|
|
RuntimeDirectoryPreserve=yes
|
|
WorkingDirectory=/usr/lib/secubox/fmrelay
|
|
ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/fmrelay.sock --log-level warning
|
|
Restart=always
|
|
RestartSec=5
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
# Security hardening
|
|
NoNewPrivileges=yes
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ReadWritePaths=/run/secubox /var/lib/secubox/fmrelay /var/log/secubox
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|