libretime/api/install/systemd/libretime-api.service

[Unit]
Description=LibreTime API Service
Requires=libretime-api.socket
PartOf=libretime.target

[Service]
NoNewPrivileges=true
CapabilityBoundingSet=
PrivateDevices=true
PrivateTmp=true
PrivateUsers=true
ProtectClock=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=full

Environment=PYTHONOPTIMIZE=2
Environment=LIBRETIME_CONFIG_FILEPATH=@@CONFIG_FILEPATH@@
Environment=LIBRETIME_LOG_FILEPATH=@@LOG_DIR@@/api.log

Type=notify
KillMode=mixed
ExecStart=@@VENV_DIR@@/bin/gunicorn \
        --workers 4 \
        --worker-class libretime_api.gunicorn.Worker \
        --log-file - \
        --bind unix:/run/libretime-api.sock \
        libretime_api.asgi
ExecReload=/bin/kill -s HUP $MAINPID
Restart=always

User=libretime
Group=libretime

[Install]
WantedBy=multi-user.target
add API v2 2020-01-30 14:47:36 +01:00			`[Unit]`
			`Description=LibreTime API Service`
feat(api): listen on unix socket with gunicorn 2022-07-06 14:21:55 +02:00			`Requires=libretime-api.socket`
feat: add systemd libretime.target - add wanted by - instantly start services in vagrant 2022-05-08 19:20:03 +02:00			`PartOf=libretime.target`
add API v2 2020-01-30 14:47:36 +01:00
			`[Service]`
feat: systemd service hardening (#2186) 2022-09-27 11:51:17 +02:00			`NoNewPrivileges=true`
			`CapabilityBoundingSet=`
			`PrivateDevices=true`
feat(api): replace uwsgi with gunicorn (#1785) Related to #1719 BREAKING: The uwsgi packages and configuration files (`/etc/airtime/libretime-api.ini`) should be removed from the system. 2022-04-25 16:09:19 +02:00			`PrivateTmp=true`
feat: systemd service hardening (#2186) 2022-09-27 11:51:17 +02:00			`PrivateUsers=true`
			`ProtectClock=true`
			`ProtectControlGroups=true`
feat: extra systemd service hardening (#2197) 2022-09-27 13:17:43 +02:00			`ProtectHostname=true`
feat: systemd service hardening (#2186) 2022-09-27 11:51:17 +02:00			`ProtectKernelLogs=true`
			`ProtectKernelModules=true`
			`ProtectKernelTunables=true`
feat: extra systemd service hardening (#2197) 2022-09-27 13:17:43 +02:00			`ProtectProc=invisible`
feat: systemd service hardening (#2186) 2022-09-27 11:51:17 +02:00			`ProtectSystem=full`
feat(api): improve uwsgi systemd integration (#1614) 2022-02-19 08:03:25 +01:00
feat: run python in optimized mode (#2874) Set PYTHONOPTIMIZE=2 to enable https://docs.python.org/3/using/cmdline.html#cmdoption-OO 2024-01-07 14:30:20 +01:00			`Environment=PYTHONOPTIMIZE=2`
feat(installer): rewrite install script - remove unused root packages.ini - write config to yaml file - allow to set public_url during install - force icecast start right after package install - move config file in place at the end of installation BREAKING CHANGE: The bash installer has been rewritten, the flags and options changed, please run `./install --help` to get more details. 2022-05-23 17:16:02 +02:00			`Environment=LIBRETIME_CONFIG_FILEPATH=@@CONFIG_FILEPATH@@`
feat: systemd service hardening (#2186) 2022-09-27 11:51:17 +02:00			`Environment=LIBRETIME_LOG_FILEPATH=@@LOG_DIR@@/api.log`
feat(api): allow to run without log file for dev BREAKING CHANGE: moved production api log file from '/var/log/airtime/api.log' to '/var/log/libretime/api.log' 2022-01-15 18:22:24 +01:00
feat: systemd service hardening (#2186) 2022-09-27 11:51:17 +02:00			`Type=notify`
			`KillMode=mixed`
feat: install inside a python3 venv 2023-04-24 15:45:34 +02:00			`ExecStart=@@VENV_DIR@@/bin/gunicorn \`
feat(api): replace uwsgi with gunicorn (#1785) Related to #1719 BREAKING: The uwsgi packages and configuration files (`/etc/airtime/libretime-api.ini`) should be removed from the system. 2022-04-25 16:09:19 +02:00			`--workers 4 \`
fix(api): move gunicorn worker config to python file (#2854) ### Description Passing the --lifespan flag to gunicorn does not forward the option to uvicorn. 2023-12-29 17:47:50 +01:00			`--worker-class libretime_api.gunicorn.Worker \`
feat(api): replace uwsgi with gunicorn (#1785) Related to #1719 BREAKING: The uwsgi packages and configuration files (`/etc/airtime/libretime-api.ini`) should be removed from the system. 2022-04-25 16:09:19 +02:00			`--log-file - \`
feat(api): listen on unix socket with gunicorn 2022-07-06 14:21:55 +02:00			`--bind unix:/run/libretime-api.sock \`
feat(api): use uvicorn as asgi server with gunicorn 2022-07-06 17:25:04 +02:00			`libretime_api.asgi`
feat(api): replace uwsgi with gunicorn (#1785) Related to #1719 BREAKING: The uwsgi packages and configuration files (`/etc/airtime/libretime-api.ini`) should be removed from the system. 2022-04-25 16:09:19 +02:00			`ExecReload=/bin/kill -s HUP $MAINPID`
feat: systemd service hardening (#2186) 2022-09-27 11:51:17 +02:00			`Restart=always`

feat: use dedicated 'libretime' user BREAKING CHANGE: The default `www-data` user has been replaced by a dedicated `libretime` user to run the services. Be sure to change the ownership of the libretime files. 2022-07-06 16:21:40 +02:00			`User=libretime`
			`Group=libretime`
add API v2 2020-01-30 14:47:36 +01:00
			`[Install]`
			`WantedBy=multi-user.target`