-
Notifications
You must be signed in to change notification settings - Fork 0
/
electrogram-bot.service
75 lines (66 loc) · 1.9 KB
/
electrogram-bot.service
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
[Unit]
Description=club elec’s Discord bot for the electrogram service
After=network.target
[Service]
Type=exec
# environment variables
Environment=HOME=/opt/electrogram-bot/
Environment=SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
Environment=BOT_TOKEN=
Environment=CHANNEL_ID=
Environment=GUILD_ID=
Environment=ELECTROGRAM_URL=https://electrogram.clubelec.org
Environment=DB_USER=
Environment=DB_PASSWORD=
Environment=DB_HOST=
Environment=DB_NAME=
Environment=ATTACHMENTS_FOLDER=shared/attachments
Environment=AVATARS_FOLDER=shared/avatars
Environment=CUSTOM_EMOJIS_FOLDER=shared/emojis
Environment=FONT_FILE=fonts/VarelaRound-Regular.ttf
Environment=INPUT_LEVEL_IMG=img/level_base.png
Environment=OUTPUT_LEVEL_FOLDER=shared/levels
Environment=ALLOWED_IMG_EXTENSIONS=.png,.jpg,.jpeg,.gif
Environment=ALLOWED_VID_EXTENSIONS=.mp4,.mov,.avi
Environment=ALLOWED_AUD_EXTENSIONS=.mp3,.wav,.ogg
# working directory and exec
WorkingDirectory=/opt/electrogram-bot
ExecStart=/opt/electrogram-bot/.env/bin/python3 main.py
ExecStop=/usr/bin/kill -9 $MAINPID
Restart=on-failure
RestartSec=10s
User=electrogram-bot
Group=electrogram-bot
# filesystem
TemporaryFileSystem=/:ro
BindReadOnlyPaths=/lib/ /lib64/ /usr/lib/ /usr/lib64/ /etc/ssl/certs/
BindReadOnlyPaths=/usr/bin/python3 /usr/bin/python3.9 /usr/bin/kill
BindPaths=/opt/electrogram-bot/
PrivateTmp=true
PrivateDevices=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectKernelLogs=true
ReadWritePaths=
# network
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
# misc
SystemCallArchitectures=native
SystemCallFilter=
NoNewPrivileges=true
RestrictRealtime=true
MemoryDenyWriteExecute=true
ProtectKernelLogs=true
LockPersonality=true
ProtectHostname=true
RemoveIPC=true
RestrictSUIDSGID=true
ProtectClock=true
ProtectProc=invisible
# capabilities
RestrictNamespaces=yes
CapabilityBoundingSet=
AmbientCapabilities=
[Install]
WantedBy=multi-user.target