mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-09-24 04:59:14 -07:00
ab0e225ff3
Sync with some of Fedora's changes, though not all. We've had DynamicUser
since the unit was added in 63b61ddab4 but it
clashes with logrotate.
Disable DynamicUser and use the dnscrypt-proxy user+group we already have.
Closes: https://bugs.gentoo.org/869872
Signed-off-by: Sam James <sam@gentoo.org>
36 lines
1.2 KiB
Plaintext
36 lines
1.2 KiB
Plaintext
[Unit]
|
|
Description=DNSCrypt-proxy client
|
|
Documentation=https://github.com/DNSCrypt/dnscrypt-proxy/wiki
|
|
Description=Encrypted/authenticated DNS proxy
|
|
ConditionFileIsExecutable=/usr/bin/dnscrypt-proxy
|
|
|
|
## systemd sockets - Do not enable unless you are very familiar with the systemd socket activation mechanism.
|
|
## Always try without systemd sockets before reporting any issues related to speed, latency or reliability.
|
|
## If you enable this, the `listen_addresses` list in the main configuration file can be empty.
|
|
## Or, at least, the addresses it contains should not overlap with the systemd socket addresses.
|
|
|
|
#Requires=dnscrypt-proxy.socket
|
|
Before=nss-lookup.target
|
|
After=network.target
|
|
Wants=network.target nss-lookup.target
|
|
|
|
[Service]
|
|
ExecStart=/usr/bin/dnscrypt-proxy --config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
|
|
NonBlocking=true
|
|
|
|
User=dnscrypt-proxy
|
|
Group=dnscrypt-proxy
|
|
|
|
ProtectControlGroups=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
|
|
## Allow binding to 127.0.0.1:53 as non-root user
|
|
## without the .socket unit
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
|
|
[Install]
|
|
#Also=dnscrypt-proxy.socket
|
|
WantedBy=multi-user.target
|