boxtec
/
bitcoin
mirror of https://github.com/bitcoin/bitcoin
4
1
Fork 0
Code Issues Projects Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '5c998a696c'
${ noResults }
bitcoin/contrib/init/bitcoind.service

86 lines
2.2 KiB
Raw Normal View History Unescape

Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually).
8 years ago
# It is not recommended to modify this file in-place, because it will
# be overwritten during package upgrades. If you want to add further
# options or overwrite existing ones then use
# $ systemctl edit bitcoind.service
# See "man systemd.service" for details.
# Note that almost all daemon options could be specified in
Improve clarity of systemd service file comments The phrasing seemed to indicate that the options specified in ExecStart= could not be specified in the config file, necessitating their inclusion in the service file. However, the options in the config file simply get overridden by any specified in ExecStart=.
5 years ago
# /etc/bitcoin/bitcoin.conf, but keep in mind those explicitly
# specified as arguments in ExecStart= will override those in the
# config file.
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually).
8 years ago
Added systemd .service file in order to help distributions integrate bitcoind.
10 years ago
[Unit]
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually).
8 years ago
Description=Bitcoin daemon
script: Add Documentation key to bitcoind.service
4 years ago
Documentation=https://github.com/bitcoin/bitcoin/blob/master/doc/init.md
script: Improve robustness of bitcoind.service on startup
4 years ago
# https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/
After=network-online.target
Wants=network-online.target
Added systemd .service file in order to help distributions integrate bitcoind.
10 years ago
[Service]
contrib/init: Better systemd integration 1. Make logs available to journalctl (systemd's logging system) by not specifying -daemonwait, which rightfully has its own set of stdout and stderr descriptors (a user invoking with -daemonwait on the command line should not see any logs). It makes more sense not to daemonize in the systemd context anyway. 2. Make systemd aware of when bitcoind is started and in steady state by specifying -startupnotify='systemd-notify --ready' and Type=notify. NotifyAccess=all is necessary so that the spawned thread for startupnotify is allowed to inform systemd of bitcoind's readiness. Note that NotifyAccess=exec won't work because it only allows sd_notify readiness signalling from Exec*= declarations in the .service file. 3. Also make systemd aware of when bitcoind is stopping by specifying -shutdownnotify='systemd-notify --stopping' Note that we currently don't allow multiple *notify commands, but users can override it in systemd via: # systemctl edit bitcoind By specifying something like: [Service] ExecStart=/usr/bin/bitcoind -pid=/run/bitcoind/bitcoind.pid \ -conf=/etc/bitcoin/bitcoin.conf \ -datadir=/var/lib/bitcoind \ -startupnotify='systemd-notify --ready; mystartupcommandhere' \ -shutdownnotify='systemd-notify --stopping; myshutdowncommandhere'
2 years ago
ExecStart=/usr/bin/bitcoind -pid=/run/bitcoind/bitcoind.pid \
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory.
6 years ago
-conf=/etc/bitcoin/bitcoin.conf \
contrib/init: Better systemd integration 1. Make logs available to journalctl (systemd's logging system) by not specifying -daemonwait, which rightfully has its own set of stdout and stderr descriptors (a user invoking with -daemonwait on the command line should not see any logs). It makes more sense not to daemonize in the systemd context anyway. 2. Make systemd aware of when bitcoind is started and in steady state by specifying -startupnotify='systemd-notify --ready' and Type=notify. NotifyAccess=all is necessary so that the spawned thread for startupnotify is allowed to inform systemd of bitcoind's readiness. Note that NotifyAccess=exec won't work because it only allows sd_notify readiness signalling from Exec*= declarations in the .service file. 3. Also make systemd aware of when bitcoind is stopping by specifying -shutdownnotify='systemd-notify --stopping' Note that we currently don't allow multiple *notify commands, but users can override it in systemd via: # systemctl edit bitcoind By specifying something like: [Service] ExecStart=/usr/bin/bitcoind -pid=/run/bitcoind/bitcoind.pid \ -conf=/etc/bitcoin/bitcoin.conf \ -datadir=/var/lib/bitcoind \ -startupnotify='systemd-notify --ready; mystartupcommandhere' \ -shutdownnotify='systemd-notify --stopping; myshutdowncommandhere'
2 years ago
-datadir=/var/lib/bitcoind \
-startupnotify='systemd-notify --ready' \
-shutdownnotify='systemd-notify --stopping'
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory.
6 years ago
Chgrp config dir to bitcoin in systemd service Rather than making the config dir world-readable, which potentially leaks RPC credentials, the group of the directory is changed to the one the service is executed as.
5 years ago
# Make sure the config directory is readable by the service user
PermissionsStartOnly=true
ExecStartPre=/bin/chgrp bitcoin /etc/bitcoin
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory.
6 years ago
# Process management
####################
contrib/init: Better systemd integration 1. Make logs available to journalctl (systemd's logging system) by not specifying -daemonwait, which rightfully has its own set of stdout and stderr descriptors (a user invoking with -daemonwait on the command line should not see any logs). It makes more sense not to daemonize in the systemd context anyway. 2. Make systemd aware of when bitcoind is started and in steady state by specifying -startupnotify='systemd-notify --ready' and Type=notify. NotifyAccess=all is necessary so that the spawned thread for startupnotify is allowed to inform systemd of bitcoind's readiness. Note that NotifyAccess=exec won't work because it only allows sd_notify readiness signalling from Exec*= declarations in the .service file. 3. Also make systemd aware of when bitcoind is stopping by specifying -shutdownnotify='systemd-notify --stopping' Note that we currently don't allow multiple *notify commands, but users can override it in systemd via: # systemctl edit bitcoind By specifying something like: [Service] ExecStart=/usr/bin/bitcoind -pid=/run/bitcoind/bitcoind.pid \ -conf=/etc/bitcoin/bitcoin.conf \ -datadir=/var/lib/bitcoind \ -startupnotify='systemd-notify --ready; mystartupcommandhere' \ -shutdownnotify='systemd-notify --stopping; myshutdowncommandhere'
2 years ago
Type=notify
NotifyAccess=all
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually).
8 years ago
PIDFile=/run/bitcoind/bitcoind.pid
contrib/init: Better systemd integration 1. Make logs available to journalctl (systemd's logging system) by not specifying -daemonwait, which rightfully has its own set of stdout and stderr descriptors (a user invoking with -daemonwait on the command line should not see any logs). It makes more sense not to daemonize in the systemd context anyway. 2. Make systemd aware of when bitcoind is started and in steady state by specifying -startupnotify='systemd-notify --ready' and Type=notify. NotifyAccess=all is necessary so that the spawned thread for startupnotify is allowed to inform systemd of bitcoind's readiness. Note that NotifyAccess=exec won't work because it only allows sd_notify readiness signalling from Exec*= declarations in the .service file. 3. Also make systemd aware of when bitcoind is stopping by specifying -shutdownnotify='systemd-notify --stopping' Note that we currently don't allow multiple *notify commands, but users can override it in systemd via: # systemctl edit bitcoind By specifying something like: [Service] ExecStart=/usr/bin/bitcoind -pid=/run/bitcoind/bitcoind.pid \ -conf=/etc/bitcoin/bitcoin.conf \ -datadir=/var/lib/bitcoind \ -startupnotify='systemd-notify --ready; mystartupcommandhere' \ -shutdownnotify='systemd-notify --stopping; myshutdowncommandhere'
2 years ago
Improve bitcoind systemd service file Add comment how further options can be added or existing ones modified. Use /run/${RuntimeDirectory} for PID file. Remove TimeoutStopSec, TimeoutStartSec, StartLimitInterval, StartLimitBurst directives as those should be set indivdually. Remove Group to user the bitcoin user's default group. Changed Restart from 'always' to 'on-failure' (can also be overwritten individually).
8 years ago
Restart=on-failure
contrib: Use -daemonwait in systemd init script Closes #21322 by making bitcoind conform to behavior specified for `type=forking`.
4 years ago
TimeoutStartSec=infinity
Set init stop timeout to 10 min `bitcoind` can take a long time to flush its db cache to disk upon shutdown. Most init files send a `SIGKILL` after a timeout of 1 minute, causing unclean shutdowns and triggering a long "Rolling forward" at the next startup. Increasing this timeout to 10 minutes should reduce how often this occurs, especially during IBD. fixup! Set ProtectHome in systemd service file
5 years ago
TimeoutStopSec=600
Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services.
7 years ago
init: Use systemd automatic directory creation Tell systemd to create, set, and ensure the right mode for the PID, configuration, and data directories. Only the exec bit is set for groups for the aforementioned directories. This is the least privilege perm that allows for the reading/writing/execing of files under the directory _if_ the files themselves give permission to its group to do so (e.g. when -sysperms is specified). Note that this does not allow for the listing of files under the directory.
6 years ago
# Directory creation and permissions
####################################
# Run as bitcoin:bitcoin
User=bitcoin
Group=bitcoin
# /run/bitcoind
RuntimeDirectory=bitcoind
RuntimeDirectoryMode=0710
# /etc/bitcoin
ConfigurationDirectory=bitcoin
ConfigurationDirectoryMode=0710
# /var/lib/bitcoind
StateDirectory=bitcoind
StateDirectoryMode=0710
Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services.
7 years ago
# Hardening measures
####################
# Provide a private /tmp and /var/tmp.
Added systemd .service file in order to help distributions integrate bitcoind.
10 years ago
PrivateTmp=true
Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services.
7 years ago
# Mount /usr, /boot/ and /etc read-only for the process.
ProtectSystem=full
Set ProtectHome in systemd service file Further hardening; the service should be run with as many restrictions as possible without breaking it.
5 years ago
# Deny access to /home, /root and /run/user
ProtectHome=true
Apply hardening measurements in bitcoind systemd service file Adds typical systemd hardening measurements for network services.
7 years ago
# Disallow the process and all of its children to gain
# new privileges through execve().
NoNewPrivileges=true
# Use a new /dev namespace only populated with API pseudo devices
# such as /dev/null, /dev/zero and /dev/random.
PrivateDevices=true
# Deny the creation of writable and executable memory mappings.
MemoryDenyWriteExecute=true
Added systemd .service file in order to help distributions integrate bitcoind.
10 years ago
[Install]
WantedBy=multi-user.target