diff options
| author | Starfall <us@starfall.systems> | 2022-01-31 12:50:14 -0600 |
|---|---|---|
| committer | Starfall <us@starfall.systems> | 2022-01-31 12:50:14 -0600 |
| commit | 17265f47f8f931e70699088dd8bd2a1c7b78112b (patch) | |
| tree | a1dde2630cd8e481cc4c5d047c4af241a251def0 /dist/mastodon-sidekiq.service | |
| parent | 129962006c2ebcd195561ac556887dc87d32081c (diff) | |
| parent | d6f3261c6cb810ea4eb6f74b9ee62af0d94cbd52 (diff) | |
Merge branch 'glitchsoc'
Diffstat (limited to 'dist/mastodon-sidekiq.service')
| -rw-r--r-- | dist/mastodon-sidekiq.service | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/dist/mastodon-sidekiq.service b/dist/mastodon-sidekiq.service index 9dd21b8a0..324cd5a39 100644 --- a/dist/mastodon-sidekiq.service +++ b/dist/mastodon-sidekiq.service @@ -9,9 +9,13 @@ WorkingDirectory=/home/mastodon/live Environment="RAILS_ENV=production" Environment="DB_POOL=25" Environment="MALLOC_ARENA_MAX=2" +Environment="LD_PRELOAD=libjemalloc.so" ExecStart=/home/mastodon/.rbenv/shims/bundle exec sidekiq -c 25 TimeoutSec=15 Restart=always +# Proc filesystem +ProcSubset=pid +ProtectProc=invisible # Capabilities CapabilityBoundingSet= # Security @@ -34,11 +38,16 @@ RestrictNamespaces=true LockPersonality=true RestrictRealtime=true RestrictSUIDSGID=true +RemoveIPC=true PrivateMounts=true ProtectClock=true # System Call Filtering SystemCallArchitectures=native -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap +SystemCallFilter=~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid +SystemCallFilter=@chown +SystemCallFilter=pipe +SystemCallFilter=pipe2 +ReadWritePaths=/home/mastodon/live [Install] WantedBy=multi-user.target |