milestone 11: systemd and docker packaging, operator and architecture docs, config and api reference, docs drift guards

2026-08-02 15:24:10 +02:00
parent a589df7515
commit bdb6ffab7a
29 changed files with 1936 additions and 94 deletions
@@ -0,0 +1,49 @@
+[Unit]
+Description=nxdns DNS sinkhole
+Documentation=https://git.mial.net/mokhtar/nxdns
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=nxdns
+Group=nxdns
+ExecStart=/usr/local/bin/nxdns run
+
+# nxdns logs to stderr by default; systemd captures it into the journal.
+StateDirectory=nxdns
+StateDirectoryMode=0700
+LogsDirectory=nxdns
+ConfigurationDirectory=nxdns
+
+# Port 53 (and 443/853 when the DoH/DoT listeners are enabled).
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+UMask=0077
+SystemCallFilter=@system-service
+SystemCallArchitectures=native
+
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1 @@
+u nxdns - "nxdns DNS sinkhole"