kych.service (1718B)
1 [Unit] 2 Description=KyCH OAuth 2.0 gateway for SWIYU identity verification 3 Documentation=https://docs.taler.net/taler-kych-manual.html 4 After=network.target postgresql.service 5 Wants=postgresql.service 6 7 [Service] 8 Type=exec 9 User=kych 10 # The socket file inherits the primary group of the process, so running with 11 # Group=www-data is what lets the reverse proxy connect to it (together with 12 # UNIXPATH_MODE = 660 in kych.conf). 13 Group=www-data 14 15 # kych-oauth2-gateway serves the QR-code helper from "js/" relative to its 16 # working directory (ServeDir::new("js")); without this the /authorize page 17 # loads but the QR code silently fails. 18 WorkingDirectory=/usr/share/kych 19 20 # Creates /run/kych (0755, kych:www-data) before start. This is where UNIXPATH 21 # in the shipped kych.conf puts the listening socket. 22 RuntimeDirectory=kych 23 RuntimeDirectoryMode=0755 24 25 # Keep the directory across a stop. Under SERVE = systemd the socket inode 26 # inside it belongs to kych.socket, which goes on listening while the service 27 # is down -- the default (removing the directory on stop) would delete that 28 # socket out from under it and no client could connect again. With the shipped 29 # SERVE = unix this only leaves an empty directory on a tmpfs behind. 30 RuntimeDirectoryPreserve=yes 31 32 ExecStart=/usr/bin/kych-oauth2-gateway -c /etc/kych/kych.conf 33 34 Restart=always 35 RestartSec=1s 36 StartLimitBurst=5 37 StartLimitInterval=5s 38 39 StandardOutput=journal 40 StandardError=journal 41 42 PrivateTmp=yes 43 ProtectSystem=full 44 ProtectHome=yes 45 ProtectClock=yes 46 ProtectHostname=yes 47 ProtectControlGroups=yes 48 ProtectKernelLogs=yes 49 ProtectKernelModules=yes 50 ProtectKernelTunables=yes 51 ProtectProc=invisible 52 PrivateDevices=yes 53 NoNewPrivileges=yes 54 55 [Install] 56 WantedBy=multi-user.target