kiss-ntpd/systemd/kiss-ntpd.service

41 lines
1.0 KiB
SYSTEMD

[Unit]
Description=kiss-ntpd NTP daemon
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=0
Documentation=https://code.moparisthebest.com/moparisthebest/kiss-ntpd
Documentation=https://github.com/moparisthebest/kiss-ntpd
[Service]
ExecStart=/usr/bin/kiss-ntpd
Restart=always
RestartSec=1s
# anything under here isn't strictly needed, but probably good
# to lock this down with the minimal permissions necessary
# which are not many at all
User=kiss-ntpd
DynamicUser=yes
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectHostname=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=net
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true
RemoveIPC=true
SystemCallArchitectures=native
# these are just needed to bind to low ports
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
[Install]
WantedBy=multi-user.target