iankelling.org Git - distro-setup/blob - filesystem/etc/systemd/system/bitcoind.service

   1 # iank: copied from /a/opt/bitcoin/contrib/init/bitcoind.service
   2 # for sources as of 2022-11-14
   3
   4 # It is not recommended to modify this file in-place, because it will
   5 # be overwritten during package upgrades. If you want to add further
   6 # options or overwrite existing ones then use
   7 # $ systemctl edit bitcoind.service
   8 # See "man systemd.service" for details.
   9
  10 # Note that almost all daemon options could be specified in
  11 # /etc/bitcoin/bitcoin.conf, but keep in mind those explicitly
  12 # specified as arguments in ExecStart= will override those in the
  13 # config file.
  14
  15 [Unit]
  16 Description=Bitcoin daemon
  17 Documentation=https://github.com/bitcoin/bitcoin/blob/master/doc/init.md
  18
  19 # https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/
  20 After=network-online.target
  21 Wants=network-online.target
  22
  23 [Service]
  24 ExecStart=/usr/bin/bitcoind -daemonwait \
  25                             -pid=/run/bitcoind/bitcoind.pid \
  26                             -conf=/etc/bitcoin/bitcoin.conf \
  27                             -datadir=/var/lib/bitcoind
  28
  29 # Make sure the config directory is readable by the service user
  30 PermissionsStartOnly=true
  31 ExecStartPre=/bin/chgrp bitcoin /etc/bitcoin
  32
  33 # Process management
  34 ####################
  35
  36 Type=forking
  37 PIDFile=/run/bitcoind/bitcoind.pid
  38 Restart=on-failure
  39 TimeoutStartSec=infinity
  40 TimeoutStopSec=600
  41
  42 # Directory creation and permissions
  43 ####################################
  44
  45 # Run as bitcoin:bitcoin
  46 User=bitcoin
  47 Group=bitcoin
  48
  49 # /run/bitcoind
  50 RuntimeDirectory=bitcoind
  51 RuntimeDirectoryMode=0710
  52
  53 # /etc/bitcoin
  54 ConfigurationDirectory=bitcoin
  55 ConfigurationDirectoryMode=0710
  56
  57 # /var/lib/bitcoind
  58 StateDirectory=bitcoind
  59 StateDirectoryMode=0710
  60
  61 # Hardening measures
  62 ####################
  63
  64 # Provide a private /tmp and /var/tmp.
  65 PrivateTmp=true
  66
  67 # Mount /usr, /boot/ and /etc read-only for the process.
  68 ProtectSystem=full
  69
  70 # Deny access to /home, /root and /run/user
  71 ProtectHome=true
  72
  73 # Disallow the process and all of its children to gain
  74 # new privileges through execve().
  75 NoNewPrivileges=true
  76
  77 # Use a new /dev namespace only populated with API pseudo devices
  78 # such as /dev/null, /dev/zero and /dev/random.
  79 PrivateDevices=true
  80
  81 # Deny the creation of writable and executable memory mappings.
  82 MemoryDenyWriteExecute=true
  83
  84 [Install]
  85 WantedBy=multi-user.target