Comments (4)
But
Moreover ProtectSystem=strict and ProtectHome=read-only are implied, thus prohibiting the service to write to arbitrary file system locations.
where ProtectSystem=full
currently. ProtectSystem=
:
If set to "strict" the entire file system hierarchy is mounted read-only, except for the API file system subtrees
/dev/
,/proc/
and/sys/
(protect these directories usingPrivateDevices=
,ProtectKernelTunables=
,ProtectControlGroups=
).
from eturnal.
it might make sense to set
DynamicUser=
totrue
We'd need to figure out how to handle the ~/.erlang.cookie
file. Best solution would be to get rid of using it altogether, but there's no really nice alternative right now.
Apart from that, eturnal doesn't store any persistent data indeed, at least not yet.
ProtectSystem=strict
eturnal should work fine with strict
, it's just not supported by older systemd versions, so I'm using full
for compatibility with those.
from eturnal.
it might make sense to set
DynamicUser=
totrue
We'd need to figure out how to handle the
~/.erlang.cookie
file. Best solution would be to get rid of using it altogether, but there's no really nice alternative right now.Apart from that, eturnal doesn't store any persistent data indeed, at least not yet.
Also, with LogsDirectory=
removed – it is present in the upstream template –, and the log directory being part of the installation prefix, the log directory needs to be listed in ReadWritePaths=
.
from eturnal.
Apart from that, eturnal doesn't store any persistent data indeed, at least not yet.
However, if we do set DynamicUser=true
and then need persistent data storage later on, it might not be straightforward to revert that setting, as the systemd unit configuration isn't necessarily replaced on upgrade. Therefore, I think we should rather not apply this to the upstream unit file.
from eturnal.
Related Issues (20)
- To facilitate rollover, the TURN server SHOULD be able to validate incoming MESSAGE-INTEGRITY tokens based on at least 2 shared secrets at any time. HOT 2
- Reload certificates on eturnalctl reload HOT 2
- Proxy Protocol - eturnal behind reverse proxy HOT 15
- Eturnal not starting on Rocky Linux 8.5 HOT 8
- ETURNAL_SECRET variable set, command eturnalctl credentials fails HOT 1
- windows service cannot start if i change the installation dir HOT 2
- UDP error not handled gracefully HOT 8
- Support environment variables for relay addresses
- Add Prometheus exporter
- Support new STUN and TURN RFCs
- Add REST API HOT 4
- Support hot release upgrades
- Include 'ssl' dependency
- My servers are being attacked by some bad persons HOT 3
- TLS example HOT 7
- Crash report on log HOT 3
- TURN windows version login account information? HOT 9
- Root cause of Rejecting permission creation request: Forbidden HOT 2
- Documentation: Provide some information about running eturnal in podman rootless environments
- SSL key outdated? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from eturnal.