Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

etc: add hnsd systemd service #18

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

etc: add hnsd systemd service #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6bff750
etc: add hnsd systemd service
tuxcanfly Sep 17, 2019
c41c6ac
etc: update systemd service
tuxcanfly Sep 18, 2019
e80b5d5
etc: fix hnsd execstart
tuxcanfly Sep 18, 2019
7523f69
etc: add man hnsd to service doc
tuxcanfly Sep 18, 2019
2e75352
etc: pass cmd line params to systemd
tuxcanfly Sep 18, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions etc/hnsd.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
# Sample hnsd config file (/etc/hnsd.conf) to be used with systemd

# set HNSD_CONFIG to the corresponding command line params
#HNSD_CONFIG=

#-n, --ns-host <ip[:port]>
#IP address and port for root nameserver, e.g. 127.0.0.1:5369.

#-r, --rs-host <ip[:port]>
#IP address and port for recursive nameserver, e.g. 127.0.0.1:53.

#-i, --ns-ip <ip>
#Public IP for NS records in the root zone.

#-u, --rs-config <config>
#Path to unbound config file.

#-p, --pool-size <size>
#Size of peer pool.

#-k, --identity-key <hex-string>
#Identity key for signing DNS responses as well as P2P messages.

#-s, --seeds <seed1,seed2,...>
#Extra seeds to connect to on the P2P network.
#Example:
#-s aorsxa4ylaacshipyjkfbvzfkh3jhh4yowtoqdt64nzemqtiw2whk@127.0.0.1

#-l, --log-file <filename>
#Redirect output to a log file.

#-d, --daemon
#Fork and background the process.
38 changes: 38 additions & 0 deletions etc/hnsd.service
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
[Unit]
Description=Handshake Name Resolution
Documentation=man:hnsd(8)
Documentation=https://handshake-org.github.io/
DefaultDependencies=no
After=systemd-sysusers.service systemd-networkd.service
Before=network.target nss-lookup.target shutdown.target
Conflicts=shutdown.target
Wants=nss-lookup.target

[Service]
AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
EnvironmentFile=/etc/hnsd.conf
ExecStart=/usr/bin/hnsd $HNSD_CONFIG
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Were you planning on removing $HNSD_CONFIG?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, its injected from /etc/hnsd.conf. It's a bit of hack to resemble a configuration file, but all it does is set the env var that gets passed to the executable.

This is only necessary since we don't have config parsing as of yet.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd just recommend that flags be used and a sane default be put in the service file.

eg:

hnsd -r 127.0.0.1:53

LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=strict
Restart=always
RestartSec=0
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
WatchdogSec=3min

[Install]
WantedBy=multi-user.target
Alias=dbus-org.freedesktop.resolve1.service