initial commit

deploy/vibedns.service

@@ -0,0 +1,71 @@
+[Unit]
+Description=VibeDNS - The AI generated DNS server designed to solve an idiots neiche problems
+Documentation=https://github.com/owen/vibedns
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=vibedns
+Group=vibedns
+
+ExecStart=/usr/local/bin/vibedns serve \
+    --db /var/lib/vibedns/dns.db \
+    --http 127.0.0.1:8080 \
+    --dns 0.0.0.0:53
+
+# The administrator password is generated on first start and printed to the
+# journal exactly once. To set your own instead, put it in an environment file
+# readable only by root and uncomment the line below:
+#   echo 'VIBEDNS_ADMIN_PASSWORD=...' > /etc/vibedns.env && chmod 600 /etc/vibedns.env
+# EnvironmentFile=-/etc/vibedns.env
+
+Restart=on-failure
+RestartSec=5s
+
+# Binding port 53 without running as root. This is the whole reason the service
+# can drop to an unprivileged user.
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+# The database and backups are the only paths that need to be writable.
+StateDirectory=vibedns
+StateDirectoryMode=0750
+ReadWritePaths=/var/lib/vibedns
+
+# Sandboxing. Each of these closes off something a DNS server has no business
+# touching, so a flaw in parsing a hostile response has far less to work with.
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+UMask=0077
+
+# Resource ceilings. A DNS server holds many concurrent sockets; the memory
+# limit is generous enough for a large cache plus several big blocklists.
+LimitNOFILE=65535
+MemoryMax=2G
+TasksMax=512
+
+# Journal identification
+SyslogIdentifier=vibedns
+
+[Install]
+WantedBy=multi-user.target