Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update listmonk@.service #1614

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Update listmonk@.service #1614

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9e9b207
Update listmonk@.service
MaximilianKohler Dec 3, 2023
efb07ac
Update listmonk@.service
MaximilianKohler Dec 11, 2023
8d75d54
Update listmonk@.service - reverse some changes and add static dir
MaximilianKohler Dec 11, 2023
d031970
fix static dir
MaximilianKohler Dec 11, 2023
504813a
change fetch static files cmd
MaximilianKohler Dec 12, 2023
fdb3180
add optional log file
MaximilianKohler Dec 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
27 changes: 24 additions & 3 deletions listmonk@.service
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
# This service template is designed to have the ability to run more than one instance of listmonk with different configurations but the same service unit.
# It may not work with older OS's with older systemd versions.

[Unit]
Description=listmonk mailing list and newsletter manager (%I)
ConditionPathExists=/etc/listmonk/%i.toml
Expand All @@ -8,12 +11,23 @@ After=postgresql.service

[Service]
Type=simple
PermissionsStartOnly=true
EnvironmentFile=-/etc/default/listmonk
EnvironmentFile=-/etc/default/listmonk-%i
ExecStartPre=/usr/bin/mkdir -p "${HOME}/uploads"
ExecStartPre=/usr/bin/mkdir -p "/etc/listmonk/uploads"
ExecStartPre=/usr/bin/listmonk --config /etc/listmonk/%i.toml --upgrade --yes
ExecStart=/usr/bin/listmonk --config /etc/listmonk/%i.toml $SYSTEMD_LISTMONK_ARGS
TimeoutStopSec=10
Restart=on-failure
RestartSec=5

# To enable a static dir, add the following
# --static-dir /etc/listmonk/static
# to the end of the ExecStart line above after creating the dir and fetching the files with:
# mkdir -p /etc/listmonk/static ; wget -O - https://github.com/knadh/listmonk/archive/master.tar.gz | tar xz -C /etc/listmonk/static --strip=2 "listmonk-master/static"

# To enable a log file that persists after restarts, replace the ExecStart= line with:
# ExecStart=/bin/bash -ce "exec /usr/bin/listmonk --config /etc/listmonk/config.toml --static-dir /etc/listmonk/static >>/etc/listmonk/listmonk.log 2>&1"

# Create dynamic users for listmonk service instances
# but create a state directory for uploads in /var/lib/private/%i.
Expand All @@ -32,18 +46,25 @@ NoNewPrivileges=True
CapabilityBoundingSet=
# listmonk only executes native code with no need for any other ABIs.
SystemCallArchitectures=native

# Only enable a reasonable set of system calls.
# see: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#SystemCallFilter=
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
# may give dump error https://mumaritc.hashnode.dev/how-to-install-listmonk-using-binary-on-ubuntu-2204
# SystemCallFilter=@system-service
# SystemCallFilter=~@privileged

# ProtectSystem=strict, which is implied by DynamicUser=True, already disabled write calls
# to the entire filesystem hierarchy, leaving only /dev/, /proc/, and /sys/ writable.
# listmonk doesn’t need access to those so might as well disable them.
PrivateDevices=True
ProtectControlGroups=True
ProtectKernelTunables=True

# Make /home/, /root/, and /run/user/ inaccessible.
# If you set ExecStartPre=/usr/bin/mkdir -p "listmonk/uploads" to a directory in /home/ or /root/ it will cause uploads to fail
# See https://github.com/knadh/listmonk/issues/843#issuecomment-1836023524
ProtectHome=True

# listmonk doesn’t handle any specific device nodes.
DeviceAllow=False
# listmonk doesn’t make use of linux namespaces.
Expand Down