release: bal-server-0.1.0

bal-server.service

@@ -4,34 +4,46 @@ After=network.target
 
 [Service]
 
-EnvironmentFile=/etc/bal/bal-server.env
+# Service execution
+###################
+EnvironmentFile=/home/bal/bal-server.env
 
 ExecStart=/usr/local/bin/bal-server 
 
-StandardOutput=syslog
-StandardError=syslog
 SyslogIdentifier=bal-server
 
+# Process management
+####################
 Type=simple
 PIDFile=/run/bal-server/bal-server.pid
 Restart=always
 TimeoutSec=300
 RestartSec=30
 
+# Directory creation and permissions
+####################################
 User=bal
 UMask=0027
 
+# /run/bal-server
 RuntimeDirectory=bal-server
 RuntimeDirectoryMode=0710
 
-PrivateTmp=true
+# Hardening measures
+####################
 
+# Mount /usr, /boot/ and /etc read-only for the process.
 ProtectSystem=full
 
+# Disallow the process and all of its children to gain
+# new privileges through execve().
 NoNewPrivileges=true
 
+# Use a new /dev namespace only populated with API pseudo devices
+# such as /dev/null, /dev/zero and /dev/random.
 PrivateDevices=true
 
+# Deny the creation of writable and executable memory mappings.
 MemoryDenyWriteExecute=true
 
 [Install]