First git commit

bbs/txt3-bbs.service

@@ -0,0 +1,43 @@
+[Unit]
+Description=txt3 BBS (telnet front-end for wap.txt3.net)
+Documentation=https://wap.txt3.net/about.php
+After=network-online.target tailscaled.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=txt3
+Group=txt3
+WorkingDirectory=/home/txt3/domains/wap.txt3.net/bbs
+ExecStart=/usr/bin/python3 /home/txt3/domains/wap.txt3.net/bbs/bbsd.py
+Environment=BBS_HOST=100.127.96.105
+Environment=BBS_PORT=12300
+Environment=BBS_DB=/home/txt3/domains/wap.txt3.net/public_html/data/wap.sqlite
+Environment=BBS_PHP=/usr/bin/php
+Environment=PYTHONUNBUFFERED=1
+
+# The service only ever needs its own code, the shared sqlite db, and php for
+# bcrypt hashing. Everything else is locked down.
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/home/txt3/domains/wap.txt3.net/public_html/data
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictNamespaces=yes
+RestrictSUIDSGID=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+LockPersonality=yes
+MemoryDenyWriteExecute=no
+# tailscale-only listener, so no need for extra port capabilities
+CapabilityBoundingSet=
+
+Restart=on-failure
+RestartSec=5
+StandardOutput=append:/home/txt3/domains/wap.txt3.net/bbs/bbs.log
+StandardError=append:/home/txt3/domains/wap.txt3.net/bbs/bbs.log
+
+[Install]
+WantedBy=multi-user.target