Kyle Isom
7b11f527f2
Ship mcns.service, mcns-backup.service, mcns-backup.timer, and deploy/scripts/install.sh adapted from MCR's deployment files. Includes full security hardening block per engineering standards and AmbientCapabilities=CAP_NET_BIND_SERVICE for DNS port 53. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
35 lines
709 B
Desktop File
35 lines
709 B
Desktop File
[Unit]
|
|
Description=MCNS Networking Service
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=mcns
|
|
Group=mcns
|
|
ExecStart=/usr/local/bin/mcns server --config /srv/mcns/mcns.toml
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Security hardening
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
RestrictRealtime=true
|
|
ReadWritePaths=/srv/mcns
|
|
|
|
# Allow binding to privileged ports (DNS port 53)
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|