iankelling.org Git - distro-setup/blob - filesystem/etc/systemd/system/openvpn-client-tr@.service

   1 [Unit]
   2 Description=OpenVPN tunnel for %I
   3 After=syslog.target network-online.target vpn-static-ip@%i.service
   4 Requires=vpn-static-ip@%i.service
   5 Wants=network-online.target
   6 Documentation=man:openvpn(8)
   7 Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
   8 Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
   9 Requires=iptables.service
  10
  11 [Service]
  12 Type=notify
  13 RuntimeDirectory=openvpn-client
  14 RuntimeDirectoryMode=0710
  15 WorkingDirectory=/etc/openvpn/client
  16 ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config /etc/openvpn/client/%i.conf
  17 # todo, try reenabling this from the default openvpn,
  18 # it was disabled so we could do bind mounts as a command,
  19 # but now systemd handles it
  20 #CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
  21 LimitNPROC=10
  22 # DeviceAllow=/dev/null rw
  23 # DeviceAllow=/dev/net/tun rw
  24
  25 ExecStartPre=/usr/bin/flock -w 20 /tmp/newns.flock /a/bin/newns/newns -n 10.173.0 start %i
  26 ExecStartPre=/sbin/iptables-restore /a/bin/distro-setup/transmission-firewall/netns.rules
  27 # allow wireguard network to connect
  28 ExecStartPre=/usr/sbin/ip r add 10.8.0.0/24 via 10.173.0.1 dev veth1-client
  29 ExecStopPost=/usr/bin/flock -w 20 /tmp/newns.flock /a/bin/newns/newns stop %i
  30 PrivateNetwork=true
  31 BindReadOnlyPaths=/etc/tr-resolv:/run/systemd/resolve:norbind /etc/basic-nsswitch:/etc/resolved-nsswitch:norbind
  32
  33 [Install]
  34 WantedBy=multi-user.target