2ec1bda2cc
td-server start web | worker | all. The web process serves the website, API and git; the worker verifies, merges, runs remote checks and refreshes the Ghidra project. They share the database and the repository, so restarting one never interrupts the other. Remote checks are queued in check_jobs and picked up by the worker. Web files are read from disk per request, so page changes need no restart at all. The web unit no longer has docker access. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
41 lines
1.2 KiB
Desktop File
41 lines
1.2 KiB
Desktop File
[Unit]
|
|
Description=Clank Together coordinator: website, API and git
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=togetherdecomp
|
|
Group=togetherdecomp
|
|
WorkingDirectory=/var/lib/togetherdecomp
|
|
ExecStart=/opt/node/bin/node --disable-warning=ExperimentalWarning /opt/togetherdecomp/src/server/cli.js start web --data /var/lib/togetherdecomp
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
Environment=NODE_ENV=production
|
|
|
|
# Hardening. The process needs: its data dir and git. Compiling happens in togetherdecomp-worker.
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadWritePaths=/var/lib/togetherdecomp
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectControlGroups=true
|
|
ProtectClock=true
|
|
ProtectHostname=true
|
|
RestrictSUIDSGID=true
|
|
RestrictRealtime=true
|
|
RestrictNamespaces=true
|
|
LockPersonality=true
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
CapabilityBoundingSet=
|
|
SystemCallArchitectures=native
|
|
# 0022 so the sandboxed (uid-remapped) compiler can read job files; the data
|
|
# dir itself is 0700, which keeps everything private to this user.
|
|
UMask=0022
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|