paivana-httpd.service (3897B)
1 [Unit] 2 StartLimitIntervalSec=0 3 Description=Paivana Taler paywall reverse proxy 4 After=network.target 5 Requires=paivana-httpd.socket 6 7 # Startup is deliberately fail-closed: paivana-httpd refuses to serve 8 # anything until it has loaded every paywall template from the merchant 9 # backend, because a template it could not load is a set of URLs it 10 # would hand out for free. A backend that is merely restarting must 11 # therefore be ridden out by restarting us, using the fixed retry 12 # delay below -- so the start rate limiter must NOT be allowed to give 13 # up and leave the unit failed. A configuration error is the opposite 14 # case and is handled by RestartPreventExitStatus. 15 16 [Service] 17 # DD102: retry transient failures without a start-rate limit. 18 Restart=always 19 RestartSec=10s 20 User=paivana-httpd 21 Type=simple 22 RestartMode=direct 23 24 # 9 is EXIT_NO_RESTART, 6 is EXIT_NOTCONFIGURED (src/include/platform.h). 25 # Neither is transient: retrying a missing DESTINATION_BASE_URL or an 26 # unparseable TRUSTED_PROXIES only fills the journal. 27 RestartPreventExitStatus=6 9 28 29 # RuntimeMaxSec is incompatible with DD102 socket lifetime on systemd 257: 30 # reaching the limit stops the bound socket and cancels automatic recovery. 31 32 # Paivana's current GNUnet/Taler event loop uses select(), whose fd_set has 33 # 1024 entries on this platform. Raising this value would let libraries open 34 # descriptors Paivana cannot poll. The default CONNECTION_LIMIT=384 budgets 35 # two descriptors per request and leaves the remaining 256 for listeners, 36 # scheduler/library state, resolver activity and transient overlap. 37 LimitNOFILE=1024 38 39 # SHUTDOWN_GRACE_PERIOD defaults to 60 s. The extra 15 s lets Paivana cancel 40 # remaining curl work, stop MHD and release templates before systemd sends 41 # SIGKILL; keep this value above the configured application grace period. 42 TimeoutStopSec=75s 43 # -f: we are served over a Unix socket by nginx/Apache (see the 44 # shipped site configs), so the client address has to come from the 45 # forwarding headers -- a Unix peer has no address of its own, and 46 # without this every visitor would be indistinguishable. It is only 47 # safe because those configs overwrite the headers rather than 48 # appending to a client-supplied value; do not enable it for a 49 # paivana-httpd that is reachable directly. 50 ExecStart=/usr/bin/paivana-httpd -c /etc/paivana/paivana.conf -f -L INFO 51 52 StandardOutput=journal 53 StandardError=journal 54 55 # libgnunetcurl records every completed outbound request at INFO. That is 56 # useful while debugging, but turns the production journal into an access log 57 # for every request Paivana proxies. Keep INFO for Paivana's lifecycle and 58 # recovery messages while limiting that library source file to actionable 59 # severities. The merchant client also emits one generic warning for every 60 # failed order poll; Paivana's sampled warning has timing, concurrency and fd 61 # context, so suppress the duplicate library warning in production. The final 62 # rule deliberately restores INFO for every other source file. 63 Environment="GNUNET_FORCE_LOG=;curl.c;;;WARNING/;merchant_api_get-private-orders-ORDER_ID.c;;;ERROR/;;;;INFO" 64 65 # Hardening. paivana-httpd needs a listening socket handed to it, 66 # outbound TCP to the merchant backend and the origin, and read access 67 # to its own configuration -- nothing else. DynamicUser is deliberately 68 # NOT used: paivana-httpd.socket names SocketUser=paivana-httpd, which 69 # needs a stable account. 70 PrivateTmp=yes 71 PrivateDevices=yes 72 ProtectSystem=strict 73 ProtectHome=yes 74 ProtectKernelTunables=yes 75 ProtectKernelModules=yes 76 ProtectControlGroups=yes 77 NoNewPrivileges=yes 78 RestrictSUIDSGID=yes 79 RestrictNamespaces=yes 80 LockPersonality=yes 81 MemoryDenyWriteExecute=yes 82 RestrictRealtime=yes 83 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 84 CapabilityBoundingSet= 85 SystemCallArchitectures=native 86 SystemCallFilter=@system-service 87 SystemCallErrorNumber=EPERM 88 89 [Install] 90 WantedBy=multi-user.target