kych

OAuth 2.0 API for Swiyu to enable Taler integration of Swiyu for KYC (experimental)
Log | Files | Refs | Submodules | README | LICENSE

kych.service (2111B)

      1 [Unit]
      2 Description=KyCH OAuth 2.0 gateway for SWIYU identity verification
      3 Documentation=https://docs.taler.net/taler-kych-manual.html
      4 After=network.target postgresql.service
      5 Wants=postgresql.service
      6 
      7 [Service]
      8 Type=exec
      9 User=kych
     10 # The socket file inherits the primary group of the process, so running with
     11 # Group=www-data is what lets the reverse proxy connect to it (together with
     12 # UNIXPATH_MODE = 660 in kych.conf).
     13 Group=www-data
     14 
     15 # Because Group= replaces the primary group, systemd does not give the process
     16 # the groups the kych user is a member of -- they have to be named here.  The
     17 # one that matters is kych itself: /etc/kych/kych.conf is root:kych 0640, since
     18 # it holds the client secrets, so without this the daemon cannot read its own
     19 # configuration and exits with "permission denied".
     20 SupplementaryGroups=kych
     21 
     22 # kych-oauth2-gateway serves the QR-code helper from "js/" relative to its
     23 # working directory (ServeDir::new("js")); without this the /authorize page
     24 # loads but the QR code silently fails.
     25 WorkingDirectory=/usr/share/kych
     26 
     27 # Creates /run/kych (0755, kych:www-data) before start.  This is where UNIXPATH
     28 # in the shipped kych.conf puts the listening socket.
     29 RuntimeDirectory=kych
     30 RuntimeDirectoryMode=0755
     31 
     32 # Keep the directory across a stop.  Under SERVE = systemd the socket inode
     33 # inside it belongs to kych.socket, which goes on listening while the service
     34 # is down -- the default (removing the directory on stop) would delete that
     35 # socket out from under it and no client could connect again.  With the shipped
     36 # SERVE = unix this only leaves an empty directory on a tmpfs behind.
     37 RuntimeDirectoryPreserve=yes
     38 
     39 ExecStart=/usr/bin/kych-oauth2-gateway -c /etc/kych/kych.conf
     40 
     41 Restart=always
     42 RestartSec=1s
     43 StartLimitBurst=5
     44 StartLimitInterval=5s
     45 
     46 StandardOutput=journal
     47 StandardError=journal
     48 
     49 PrivateTmp=yes
     50 ProtectSystem=full
     51 ProtectHome=yes
     52 ProtectClock=yes
     53 ProtectHostname=yes
     54 ProtectControlGroups=yes
     55 ProtectKernelLogs=yes
     56 ProtectKernelModules=yes
     57 ProtectKernelTunables=yes
     58 ProtectProc=invisible
     59 PrivateDevices=yes
     60 NoNewPrivileges=yes
     61 
     62 [Install]
     63 WantedBy=multi-user.target