paivana-httpd.service (2914B)
1 [Unit] 2 Description=Paivana Taler paywall reverse proxy 3 After=network.target 4 Requires=paivana-httpd.socket 5 6 # Startup is deliberately fail-closed: paivana-httpd refuses to serve 7 # anything until it has loaded every paywall template from the merchant 8 # backend, because a template it could not load is a set of URLs it 9 # would hand out for free. A backend that is merely restarting must 10 # therefore be ridden out by restarting us, which is what the back-off 11 # below is for -- so the start rate limiter must NOT be allowed to give 12 # up and leave the unit failed. A configuration error is the opposite 13 # case and is handled by RestartPreventExitStatus. 14 StartLimitIntervalSec=0 15 16 [Service] 17 User=paivana-httpd 18 Type=simple 19 Restart=always 20 RestartMode=direct 21 22 # Exponential back-off: 1s, 2s, 4s ... capped at 5min. A merchant 23 # backend that comes back after a minute costs us a minute of downtime, 24 # while one that is gone for a day does not spin. 25 RestartSec=1s 26 RestartSteps=10 27 RestartMaxDelaySec=300s 28 29 # 9 is EXIT_NO_RESTART, 6 is EXIT_NOTCONFIGURED (src/include/platform.h). 30 # Neither is transient: retrying a missing DESTINATION_BASE_URL or an 31 # unparseable TRUSTED_PROXIES only fills the journal. 32 RestartPreventExitStatus=6 9 33 34 # Recycle hourly. This is only tolerable because `SECRET' is now 35 # mandatory (paivana-httpd exits 6 without it) and the package 36 # generates one: with a per-start random key, every restart would 37 # invalidate every access cookie, so an hourly restart meant a customer 38 # paying at 10:59 was shown the paywall again at 11:01. 39 RuntimeMaxSec=3600s 40 # -f: we are served over a Unix socket by nginx/Apache (see the 41 # shipped site configs), so the client address has to come from the 42 # forwarding headers -- a Unix peer has no address of its own, and 43 # without this every visitor would be indistinguishable. It is only 44 # safe because those configs overwrite the headers rather than 45 # appending to a client-supplied value; do not enable it for a 46 # paivana-httpd that is reachable directly. 47 ExecStart=/usr/bin/paivana-httpd -c /etc/paivana/paivana.conf -f -L INFO 48 49 StandardOutput=journal 50 StandardError=journal 51 52 # Hardening. paivana-httpd needs a listening socket handed to it, 53 # outbound TCP to the merchant backend and the origin, and read access 54 # to its own configuration -- nothing else. DynamicUser is deliberately 55 # NOT used: paivana-httpd.socket names SocketUser=paivana-httpd, which 56 # needs a stable account. 57 PrivateTmp=yes 58 PrivateDevices=yes 59 ProtectSystem=strict 60 ProtectHome=yes 61 ProtectKernelTunables=yes 62 ProtectKernelModules=yes 63 ProtectControlGroups=yes 64 NoNewPrivileges=yes 65 RestrictSUIDSGID=yes 66 RestrictNamespaces=yes 67 LockPersonality=yes 68 MemoryDenyWriteExecute=yes 69 RestrictRealtime=yes 70 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 71 CapabilityBoundingSet= 72 SystemCallArchitectures=native 73 SystemCallFilter=@system-service 74 SystemCallErrorNumber=EPERM 75 76 [Install] 77 WantedBy=multi-user.target