mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-05 15:08:24 +00:00
DanConwayDev
22bbd48537
The production guide was NixOS-only despite presenting itself as the general deployment entry point, and its examples referenced an unavailable GitHub source and a hardening control the module does not set. Turn the entry point into an environment chooser, preserve the corrected NixOS material in its own guide, add a hardened generic systemd unit and repeatable Linux installation, document the preferred unprivileged Proxmox layout, and update repository navigation and architecture references. Each path assumes the shared deployment contract from the container change. Kubernetes automation, remote host mutation, and changes to the existing NixOS module are deliberately excluded. Validated the canonical Git remote with git ls-remote, parsed and scored the systemd unit with systemd-analyze, checked all new deployment-guide links, removed trailing whitespace, scanned the staged diff for key-shaped nsec values, and ran git diff --check.
39 lines
881 B
Desktop File
39 lines
881 B
Desktop File
[Unit]
|
|
Description=ngit-grasp GRASP relay
|
|
Documentation=https://gitworkshop.dev/danconwaydev.com/ngit-grasp
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=ngit-grasp
|
|
Group=ngit-grasp
|
|
WorkingDirectory=/var/lib/ngit-grasp
|
|
EnvironmentFile=/etc/ngit-grasp/ngit-grasp.env
|
|
Environment=PATH=/usr/local/bin:/usr/bin:/bin
|
|
ExecStart=/usr/local/bin/ngit-grasp
|
|
Restart=on-failure
|
|
RestartSec=10s
|
|
TimeoutStopSec=300s
|
|
UMask=0077
|
|
|
|
NoNewPrivileges=true
|
|
PrivateDevices=true
|
|
PrivateTmp=true
|
|
ProtectControlGroups=true
|
|
ProtectHome=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/ngit-grasp
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
LockPersonality=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|