diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2020-05-16 20:33:52 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2020-05-16 20:39:53 +0200 |
| commit | 70f16ac939497e3e424bad05c5f82ce36d1bceda (patch) | |
| tree | 652974ea391732358e1605623a35198addc11d71 /roles/git/files/etc/systemd/system/cgit.service | |
| parent | 2f9574850b356a746ee3ff9a8a311c450784b53c (diff) | |
git browser and HTTP backend: harden config and port to Debian 10.
Diffstat (limited to 'roles/git/files/etc/systemd/system/cgit.service')
| -rw-r--r-- | roles/git/files/etc/systemd/system/cgit.service | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/roles/git/files/etc/systemd/system/cgit.service b/roles/git/files/etc/systemd/system/cgit.service new file mode 100644 index 0000000..08037ac --- /dev/null +++ b/roles/git/files/etc/systemd/system/cgit.service @@ -0,0 +1,23 @@ +[Unit] +Description=hyperfast web frontend for git repositories written in C +Documentation=https://git.zx2c4.com/cgit/ + +[Service] +User=_cgit +Group=nogroup +SupplementaryGroups=gitolite +ExecStart=/usr/sbin/fcgiwrap +SyslogIdentifier=cgit +# +# Hardening +NoNewPrivileges=yes +PrivateDevices=yes +ProtectHome=yes +ProtectSystem=strict +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ReadWriteDirectories=/var/cache/cgit + +[Install] +WantedBy=multi-user.target |