diff options
Diffstat (limited to 'app-admin/vault/files/vault.service')
| -rw-r--r-- | app-admin/vault/files/vault.service | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/app-admin/vault/files/vault.service b/app-admin/vault/files/vault.service index 3071d0346277..939d8cafc24e 100644 --- a/app-admin/vault/files/vault.service +++ b/app-admin/vault/files/vault.service @@ -4,15 +4,28 @@ Requires=network-online.target After=network-online.target [Service] -User=vault Environment=VAULT_SERVER_OPTS="-config=/etc/vault.d" -ExecStart=/usr/bin/vault server $VAULT_SERVER_OPTS -CapabilityBoundingSet=CAP_IPC_LOCK -AmbientCapabilities=CAP_IPC_LOCK -Capabilities=CAP_IPC_LOCK=ep +User=vault +Group=vault +ProtectSystem=full +ProtectHome=read-only +PrivateTmp=yes +PrivateDevices=yes SecureBits=keep-caps +AmbientCapabilities=CAP_IPC_LOCK +Capabilities=CAP_IPC_LOCK+ep +CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK +NoNewPrivileges=yes +ExecStart=/usr/bin/vault server $VAULT_SERVER_OPTS +ExecReload=/bin/kill --signal HUP $MAINPID +KillMode=process +KillSignal=SIGINT Restart=on-failure -SuccessExitStatus=2 +RestartSec=5 +TimeoutStopSec=30 +StartLimitIntervalSec=60 +StartLimitBurst=3 +LimitNOFILE=65536 [Install] WantedBy=default.target |