# systemd unit for mugit. Install as /etc/systemd/system/mugit.service;
# site-specific settings go in /etc/mugit/env (see README.md).
[Unit]
Description=mugit git web front end
Documentation=https://git.highenergymagic.org/mugit
After=network-online.target
Wants=network-online.target

[Service]
User=mugit
Group=mugit
ExecStart=/opt/mugit/mugit
Environment=MUGIT_REPOS=/srv/git
Environment=MUGIT_LISTEN=[::]:80
Environment=MUGIT_TLS_LISTEN=[::]:443
Environment=MUGIT_ACME_CACHE=/var/lib/mugit/acme
EnvironmentFile=-/etc/mugit/env
Restart=on-failure
RestartSec=5

# The service binds ports 80 and 443 itself, hence the one capability.
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/mugit
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictSUIDSGID=true
RestrictNamespaces=true
LockPersonality=true
# A backstop behind mugit's own bound on git processes.
TasksMax=256
MemoryMax=1G
# Two descriptors per connection at the TLS listener, and the default 1024
# is low enough that a slow crawl of the site can reach it.
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target