up

src/systemd.sh

@@ -0,0 +1,58 @@
+install_service() {
+    case $1 in
+    $is_core)
+        is_doc_site=https://sing-box.sagernet.org/
+        cat >/lib/systemd/system/$is_core.service <<<"
+[Unit]
+Description=$is_core_name Service
+Documentation=$is_doc_site
+After=network.target nss-lookup.target
+
+[Service]
+#User=nobody
+User=root
+NoNewPrivileges=true
+ExecStart=$is_core_bin run -c $is_config_json -C $is_conf_dir
+Restart=on-failure
+RestartPreventExitStatus=23
+LimitNPROC=10000
+LimitNOFILE=1048576
+PrivateTmp=true
+ProtectSystem=full
+#CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+#AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target"
+        ;;
+    caddy)
+        cat >/lib/systemd/system/caddy.service <<<"
+#https://github.com/caddyserver/dist/blob/master/init/caddy.service
+[Unit]
+Description=Caddy
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=root
+Group=root
+ExecStart=$is_caddy_bin run --environ --config $is_caddyfile
+ExecReload=$is_caddy_bin reload --config $is_caddyfile
+TimeoutStopSec=5s
+LimitNPROC=10000
+LimitNOFILE=1048576
+PrivateTmp=true
+ProtectSystem=full
+#AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target"
+        ;;
+    esac
+
+    # enable, reload
+    systemctl enable $1
+    systemctl daemon-reload
+}