diff options
| author |   Zac Medico <zachary.medico@sony.com> | 2019-07-15 13:42:47 -0700 |
|---|---|---|
| committer |   Zac Medico <zmedico@gentoo.org> | 2019-07-15 13:51:48 -0700 |
| commit | b2cc4c52499d3a6cf509d7372a603bc265423c9e (patch) | |
| tree | d4cbd6324b3596fb03cb4bd9a7b1f1b2bbd0c68b /app-admin/vault/files | |
| parent | sys-kernel/raspberrypi-image: reuse sys-boot/raspberrypi-firmware distfile (diff) | |
| download | gentoo-b2cc4c52499d3a6cf509d7372a603bc265423c9e.tar.gz gentoo-b2cc4c52499d3a6cf509d7372a603bc265423c9e.tar.bz2 gentoo-b2cc4c52499d3a6cf509d7372a603bc265423c9e.zip | |
app-admin/vault: increase max open files
See: https://learn.hashicorp.com/vault/operations/ops-deployment-guide#step-3-configure-systemd
Package-Manager: Portage-2.3.69, Repoman-2.3.16
Copyright: Sony Interactive Entertainment Inc.
Signed-off-by: Zac Medico <zmedico@gentoo.org>
Diffstat (limited to 'app-admin/vault/files')
| -rw-r--r-- | app-admin/vault/files/vault.initd | 3 | ||||
| -rw-r--r-- | app-admin/vault/files/vault.service | 25 |
2 files changed, 21 insertions, 7 deletions
diff --git a/app-admin/vault/files/vault.initd b/app-admin/vault/files/vault.initd index d430bb8d39a9..e4bd3e7c13d0 100644 --- a/app-admin/vault/files/vault.initd +++ b/app-admin/vault/files/vault.initd @@ -1,10 +1,11 @@ #!/sbin/openrc-run -# Copyright 2015-2017 Gentoo Foundation +# Copyright 2015-2019 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 description="vault server" group=${group:-${RC_SVCNAME}} pidfile=${pidfile:-"/run/${RC_SVCNAME}.pid"} +rc_ulimit=${rc_ulimit-"-n 65536"} user=${user:-${RC_SVCNAME}} command="/usr/bin/${RC_SVCNAME}" diff --git a/app-admin/vault/files/vault.service b/app-admin/vault/files/vault.service index 3071d0346277..939d8cafc24e 100644 --- a/app-admin/vault/files/vault.service +++ b/app-admin/vault/files/vault.service @@ -4,15 +4,28 @@ Requires=network-online.target After=network-online.target [Service] -User=vault Environment=VAULT_SERVER_OPTS="-config=/etc/vault.d" -ExecStart=/usr/bin/vault server $VAULT_SERVER_OPTS -CapabilityBoundingSet=CAP_IPC_LOCK -AmbientCapabilities=CAP_IPC_LOCK -Capabilities=CAP_IPC_LOCK=ep +User=vault +Group=vault +ProtectSystem=full +ProtectHome=read-only +PrivateTmp=yes +PrivateDevices=yes SecureBits=keep-caps +AmbientCapabilities=CAP_IPC_LOCK +Capabilities=CAP_IPC_LOCK+ep +CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK +NoNewPrivileges=yes +ExecStart=/usr/bin/vault server $VAULT_SERVER_OPTS +ExecReload=/bin/kill --signal HUP $MAINPID +KillMode=process +KillSignal=SIGINT Restart=on-failure -SuccessExitStatus=2 +RestartSec=5 +TimeoutStopSec=30 +StartLimitIntervalSec=60 +StartLimitBurst=3 +LimitNOFILE=65536 [Install] WantedBy=default.target |