fix music mountpoint
[distro-setup] / filesystem / etc / systemd / system / bitcoind.service
1 # iank: copied from /a/opt/bitcoin/contrib/init/bitcoind.service
2 # for sources as of 2022-11-14
3
4 # It is not recommended to modify this file in-place, because it will
5 # be overwritten during package upgrades. If you want to add further
6 # options or overwrite existing ones then use
7 # $ systemctl edit bitcoind.service
8 # See "man systemd.service" for details.
9
10 # Note that almost all daemon options could be specified in
11 # /etc/bitcoin/bitcoin.conf, but keep in mind those explicitly
12 # specified as arguments in ExecStart= will override those in the
13 # config file.
14
15 [Unit]
16 Description=Bitcoin daemon
17 Documentation=https://github.com/bitcoin/bitcoin/blob/master/doc/init.md
18
19 # https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/
20 After=network-online.target
21 Wants=network-online.target
22
23 [Service]
24 ExecStart=/usr/bin/bitcoind -daemonwait \
25 -pid=/run/bitcoind/bitcoind.pid \
26 -conf=/etc/bitcoin/bitcoin.conf \
27 -datadir=/var/lib/bitcoind
28
29 # Make sure the config directory is readable by the service user
30 PermissionsStartOnly=true
31 ExecStartPre=/bin/chgrp bitcoin /etc/bitcoin
32
33 # Process management
34 ####################
35
36 Type=forking
37 PIDFile=/run/bitcoind/bitcoind.pid
38 Restart=on-failure
39 TimeoutStartSec=infinity
40 TimeoutStopSec=600
41
42 # Directory creation and permissions
43 ####################################
44
45 # Run as bitcoin:bitcoin
46 User=bitcoin
47 Group=bitcoin
48
49 # /run/bitcoind
50 RuntimeDirectory=bitcoind
51 RuntimeDirectoryMode=0710
52
53 # /etc/bitcoin
54 ConfigurationDirectory=bitcoin
55 ConfigurationDirectoryMode=0710
56
57 # /var/lib/bitcoind
58 StateDirectory=bitcoind
59 StateDirectoryMode=0710
60
61 # Hardening measures
62 ####################
63
64 # Provide a private /tmp and /var/tmp.
65 PrivateTmp=true
66
67 # Mount /usr, /boot/ and /etc read-only for the process.
68 ProtectSystem=full
69
70 # Deny access to /home, /root and /run/user
71 ProtectHome=true
72
73 # Disallow the process and all of its children to gain
74 # new privileges through execve().
75 NoNewPrivileges=true
76
77 # Use a new /dev namespace only populated with API pseudo devices
78 # such as /dev/null, /dev/zero and /dev/random.
79 PrivateDevices=true
80
81 # Deny the creation of writable and executable memory mappings.
82 MemoryDenyWriteExecute=true
83
84 [Install]
85 WantedBy=multi-user.target