git » dnss » next » tree

[next] / etc / systemd / dns-to-https / dnss.service 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
[Unit]
Description = dnss daemon - DNS over HTTPS mode

# Note we get the sockets via systemd, see dnss.socket.
Requires=dnss.socket

[Service]
ExecStart=/usr/local/bin/dnss \
        --dns_listen_addr=systemd \
        --monitoring_listen_addr=127.0.0.1:8081 \
        --enable_dns_to_https


Type = simple
Restart = always

# Use a dynamic user, since dnss doesn't use any persistent storage anyway.
DynamicUser = true
User = dnss
Group = dnss

# Some security measures to reduce unnecessary exposure, just in case.
CapabilityBoundingSet =
ProtectSystem = strict
PrivateUsers = true
PrivateDevices = true
RestrictNamespaces = true
ProtectControlGroups = yes
ProtectProc = invisible
ProcSubset = pid
SystemCallArchitectures = native
SystemCallFilter = @system-service
ProtectKernelModules = yes
ProtectKernelTunables = yes


[Install]
Also=dnss.socket
WantedBy = multi-user.target