blob: 17b4dec3c89d4fdb5f78497c43965a438fe48444 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
[Unit]
Description=Roentgen-owned system Xray process
Requires=roentgen-guard.service
After=roentgen-guard.service
[Service]
Type=simple
User=roentgen-xray
Group=roentgen-xray
ExecStartPre=/usr/local/bin/roentgen xray-preflight
ExecStart=/usr/bin/xray run -config /run/roentgen/xray.json
Restart=on-failure
RestartSec=5
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
NoNewPrivileges=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=strict
UMask=0077
|
