35 lines
1.1 KiB
Desktop File
35 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Trainlog Web local user service
|
|
Documentation=https://github.com/labfytools/trainlog
|
|
After=default.target
|
|
# WHY: A persistent bind failure (notably an occupied 127.0.0.1:8080) must not
|
|
# become an aggressive restart loop in the user's session.
|
|
StartLimitIntervalSec=60
|
|
StartLimitBurst=3
|
|
|
|
[Service]
|
|
Type=simple
|
|
# CONTRACT: The user-managed executable is the canonical manual and service
|
|
# entry point; the repository/build location must not leak into this unit.
|
|
ExecStart=%h/.local/bin/trainlog -w
|
|
# INVARIANT: Trainlog stays in the foreground, owns its ordered SIGTERM
|
|
# shutdown, and always keeps the frozen loopback address and port contract.
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=20
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
|
|
# These protections do not isolate the home directory: Trainlog must retain
|
|
# access to its SQLite data and configuration below ~/.local/share and ~/.config.
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectControlGroups=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
SystemCallArchitectures=native
|
|
|
|
[Install]
|
|
WantedBy=default.target
|