Download this file
| 1 | # The platform STUN/TURN relay (media roadmap stage 4a). Armed only on a |
| 2 | # box that carries /etc/carlos/relay-masters; ConditionPathExists keeps a |
| 3 | # box without a master from ever listening. Shares the box with the edge and |
| 4 | # must lose first: bounded memory, PSI-driven shedding in the process, and |
| 5 | # the highest OOM adjustment there is. |
| 6 | [Unit] |
| 7 | Description=carlos relay (STUN and TURN) |
| 8 | After=network-online.target |
| 9 | Wants=network-online.target |
| 10 | ConditionPathExists=/etc/carlos/relay-masters |
| 11 | |
| 12 | [Service] |
| 13 | EnvironmentFile=-/etc/carlos/host.env |
| 14 | ExecStart=/opt/carlos/carlos relay serve |
| 15 | Restart=always |
| 16 | RestartSec=1 |
| 17 | |
| 18 | User=carlos |
| 19 | Group=carlos |
| 20 | NoNewPrivileges=yes |
| 21 | ProtectSystem=strict |
| 22 | ProtectHome=yes |
| 23 | ReadWritePaths=/data/relay /run/carlos |
| 24 | PrivateTmp=yes |
| 25 | PrivateDevices=yes |
| 26 | ProtectClock=yes |
| 27 | ProtectHostname=yes |
| 28 | ProtectKernelTunables=yes |
| 29 | ProtectKernelModules=yes |
| 30 | ProtectKernelLogs=yes |
| 31 | ProtectControlGroups=yes |
| 32 | ProtectProc=invisible |
| 33 | RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX |
| 34 | RestrictNamespaces=yes |
| 35 | RestrictRealtime=yes |
| 36 | RestrictSUIDSGID=yes |
| 37 | LockPersonality=yes |
| 38 | MemoryDenyWriteExecute=yes |
| 39 | SystemCallFilter=@system-service |
| 40 | SystemCallErrorNumber=EPERM |
| 41 | SystemCallArchitectures=native |
| 42 | MemoryHigh=160M |
| 43 | MemoryMax=256M |
| 44 | OOMScoreAdjust=1000 |
| 45 | TasksMax=512 |
| 46 | Nice=5 |
| 47 | CPUWeight=50 |
| 48 | |
| 49 | [Install] |
| 50 | WantedBy=multi-user.target |
| 51 | |
amadan