mirror of
https://github.com/restic/rest-server.git
synced 2025-10-19 15:43:21 +00:00
a994d347ca
In addition to any existing filesystem restrictions on the (www-data) backup user these config options uses namespaces and other kernel features to further restrict what the _rest-server_ is allowed to do. * `ProtectSystem=strict` and `ReadWritePaths=/path/to/backups` ensures that the _rest-server_ is only allowed to write to its data directory. * `ProtectHome=yes` and `PrivateTmp=yes` limits what the _rest-server_ gets (read) access to. * `NoNewPrivileges=yes` prevents the _rest-server_ from using setuid binaries, etc to escalate its privileges. See https://www.freedesktop.org/software/systemd/man/systemd.exec.html for further details While at I also replaced the _/tmp/restic_ path with a more explicit placeholder path. Given that one rarely wants to backup to _/tmp_ I figured it better to force a choice of path rather than to have someone accidentally end up using _/tmp/restic_ for their backups.
22 lines
389 B
Desktop File
22 lines
389 B
Desktop File
[Unit]
|
|
Description=Rest Server
|
|
After=syslog.target
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=www-data
|
|
Group=www-data
|
|
ExecStart=/usr/local/bin/rest-server --path /path/to/backups
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# Optional security enhancements
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ReadWritePaths=/path/to/backups
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|