libreoffice-online/loolwsd.service

[Unit]
Description=Collabora Online WebSocket Daemon
After=network.target

[Service]
EnvironmentFile=-/etc/sysconfig/loolwsd
ExecStart=/usr/bin/loolwsd --version --o:sys_template_path=/opt/lool/systemplate --o:child_root_path=/opt/lool/child-roots --o:file_server_root_path=/usr/share/loolwsd
KillSignal=SIGINT
TimeoutStopSec=120
User=lool
KillMode=control-group
Restart=always
LimitNOFILE=infinity:infinity

ProtectSystem=strict
ReadWritePaths=/opt/lool /var/log

ProtectHome=yes
PrivateTmp=yes
ProtectControlGroups=yes
CapabilityBoundingSet=CAP_FOWNER CAP_CHOWN CAP_MKNOD CAP_SYS_CHROOT CAP_SYS_ADMIN

[Install]
WantedBy=multi-user.target
Try to make this handled by systemd 2015-06-01 11:53:29 -05:00			`[Unit]`
change product name Change-Id: Ic34d324c952364442d3f4f9f0758676ab57c8a9a 2020-10-02 03:53:04 -05:00			`Description=Collabora Online WebSocket Daemon`
Try to make this handled by systemd 2015-06-01 11:53:29 -05:00			`After=network.target`

			`[Service]`
			`EnvironmentFile=-/etc/sysconfig/loolwsd`
Revert "Adapt paths to new package name" It is not a good idea to change the configuration directory, it will affect all the existing installations. And the service is called loolwsd - so the configuration should be called that way too. This reverts commit 92785742896f20374fc080922d603cd76d2157ca. Change-Id: I7e6eee644e21ad2dd842742585d16133ff8e36c9 Reviewed-on: https://gerrit.libreoffice.org/72730 Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de> Tested-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de> 2019-05-22 03:41:25 -05:00			`ExecStart=/usr/bin/loolwsd --version --o:sys_template_path=/opt/lool/systemplate --o:child_root_path=/opt/lool/child-roots --o:file_server_root_path=/usr/share/loolwsd`
service: improve stop and reload SIGINT is the clean way of stopping the service, while SIGTERM is be the faster and rude way. So first we want to use SIGINT and only when we timeout do we want SIGTERM to be used. Here we ask systemd to stop WSD by sending SIGINT and wait for 120 seconds. After that timeout, it will assume the service is hung and needs to be aborted. We expect that by then we would have saved all documents and cleanly exited. 120 seconds should be sufficient time to save, close, and upload the open documents. Change-Id: I08321814db942d89a44cfce42885840f4afa279c Reviewed-on: https://gerrit.libreoffice.org/81976 Reviewed-by: Andras Timar <andras.timar@collabora.com> Tested-by: Andras Timar <andras.timar@collabora.com> 2019-11-01 10:32:23 -05:00			`KillSignal=SIGINT`
			`TimeoutStopSec=120`
Try to make this handled by systemd 2015-06-01 11:53:29 -05:00			`User=lool`
loolwsd: loolwsd.service KillMode should be control-group 2015-11-09 06:01:24 -06:00			`KillMode=control-group`
Try to make this handled by systemd 2015-06-01 11:53:29 -05:00			`Restart=always`
Remove default file descriptor limit. Change-Id: I1b811bd2fbabaa7c23861b215dc254832d200324 Reviewed-on: https://gerrit.libreoffice.org/c/online/+/100134 Tested-by: Jenkins Reviewed-by: Michael Meeks <michael.meeks@collabora.com> 2020-08-04 13:30:20 -05:00			`LimitNOFILE=infinity:infinity`
Try to make this handled by systemd 2015-06-01 11:53:29 -05:00
service: enable sandboxing options See also https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing Change-Id: I7ae1070c170db2f91dbeb177f03390a0b45143eb Reviewed-on: https://gerrit.libreoffice.org/c/online/+/88128 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com> Reviewed-by: Jan Holesovsky <kendy@collabora.com> 2020-02-06 11:43:58 -06:00			`ProtectSystem=strict`
Add /var/log (default log path) to ReadWritePaths of loolwsd.service (fixes GH #739) Signed-off-by: Andras Timar <andras.timar@collabora.com> Change-Id: I47e8a0983fd74656739498bf02bad117e821cfbf 2020-11-20 13:19:21 -06:00			`ReadWritePaths=/opt/lool /var/log`
service: enable sandboxing options See also https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing Change-Id: I7ae1070c170db2f91dbeb177f03390a0b45143eb Reviewed-on: https://gerrit.libreoffice.org/c/online/+/88128 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com> Reviewed-by: Jan Holesovsky <kendy@collabora.com> 2020-02-06 11:43:58 -06:00
			`ProtectHome=yes`
			`PrivateTmp=yes`
			`ProtectControlGroups=yes`
add CAP_CHOWN to systemd service files Signed-off-by: Andras Timar <andras.timar@collabora.com> Change-Id: I3270cc1c435c419117cfa805a4db16ca4ef9a3ec 2021-01-06 04:39:01 -06:00			`CapabilityBoundingSet=CAP_FOWNER CAP_CHOWN CAP_MKNOD CAP_SYS_CHROOT CAP_SYS_ADMIN`
service: enable sandboxing options See also https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing Change-Id: I7ae1070c170db2f91dbeb177f03390a0b45143eb Reviewed-on: https://gerrit.libreoffice.org/c/online/+/88128 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com> Reviewed-by: Jan Holesovsky <kendy@collabora.com> 2020-02-06 11:43:58 -06:00
Try to make this handled by systemd 2015-06-01 11:53:29 -05:00			`[Install]`
			`WantedBy=multi-user.target`