Running as daemon with systemd

svengo commented 7 years ago

I managed to run The Onion Box as daemon with systemd (under Ubuntu 16.04) based on the wiki:

Create user theonionbox
Install The Onion Box to ~theonionbox and sudo chmod 755 ./theonionbox.py
Edit ~theonionbox/config/theonionbox.cfgto your needs
Create service file with sudo vi /etc/systemd/system/theonionbox.service with the following content:

# Run The Onion Box as background service
# https://github.com/ralphwetzel/theonionbox/

[Unit]
Description=The Onion Box
Documentation=https://github.com/ralphwetzel/theonionbox/wiki
After=network.target

[Service]
Type=simple
User=theonionbox
WorkingDirectory=~
ExecStart=/srv/theonionbox/theonionbox.py --mode=service
Restart=on-failure

[Install]
WantedBy=multi-user.target

Start the new service with sudo systemctl start theonionbox.service
If everything is okay, start the service on next boot with sudo systemctl enable theonionbox.service

ralphwetzel commented 7 years ago

Thank you for this great contribution! I'll add the service file to the next release.

AnanasPfirsichSaft commented 6 years ago

Maybe the service file can be hardened? My Debian Jessie box (Bananian Linux) use no systemd by default. Therefore I cannot dive into it at the moment. But my snippet should be a good start. Capabilities and syscalls whitelist are still missing. Some directives may be only available on newer systemd versions.

[service]
ProtectSystem=full
ReadWriteDirectories=/var/log/theonionbox
CapabilityBoundingSet=???
SystemCallFilter=???
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true

What do others think?

ralphwetzel / theonionbox

Running as daemon with systemd #24