Download this file
| 1 | [Unit] |
| 2 | Description=lchat auto-updater (one release-channel update pass) |
| 3 | After=network-online.target |
| 4 | Wants=network-online.target |
| 5 | |
| 6 | [Service] |
| 7 | Type=oneshot |
| 8 | # Optional override: LCHAT_UPDATE_MANIFEST_URL (point a box at another feed). |
| 9 | EnvironmentFile=-/data/update.env |
| 10 | ExecStart=/opt/lchat/lchat update run |
| 11 | |
| 12 | # --- hardening (see docs/instance-router.md § Hardening) --- |
| 13 | # Runs as ROOT deliberately, like lchat-control: an update pass writes the |
| 14 | # version store (/opt/lchat) and restarts instance units via systemctl. It is |
| 15 | # fired by lchat-update.timer, never routed or listening. NoNewPrivileges and |
| 16 | # the syscall filter are omitted for the systemctl child; the rest applies. |
| 17 | ProtectHome=yes |
| 18 | PrivateTmp=yes |
| 19 | PrivateDevices=yes |
| 20 | ProtectClock=yes |
| 21 | ProtectHostname=yes |
| 22 | ProtectKernelTunables=yes |
| 23 | ProtectKernelModules=yes |
| 24 | ProtectKernelLogs=yes |
| 25 | RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX |
| 26 | RestrictNamespaces=yes |
| 27 | RestrictRealtime=yes |
| 28 | LockPersonality=yes |
| 29 | MemoryDenyWriteExecute=yes |
| 30 | MemoryMax=256M |
| 31 | TasksMax=64 |
| 32 | |
amadan