2016-01-21 12:40:12 +00:00
|
|
|
[Unit]
|
|
|
|
|
Description=Traefik
|
2020-09-23 08:20:04 +00:00
|
|
|
Documentation=https://doc.traefik.io/traefik/
|
2019-01-07 18:02:03 +00:00
|
|
|
#After=network-online.target
|
|
|
|
|
#AssertFileIsExecutable=/usr/bin/traefik
|
|
|
|
|
#AssertPathExists=/etc/traefik/traefik.toml
|
2016-01-21 12:40:12 +00:00
|
|
|
|
|
|
|
|
[Service]
|
2019-01-07 18:02:03 +00:00
|
|
|
# Run traefik as its own user (create new user with: useradd -r -s /bin/false -U -M traefik)
|
|
|
|
|
#User=traefik
|
|
|
|
|
#AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
|
|
|
|
|
|
|
|
# configure service behavior
|
2016-10-25 15:59:39 +00:00
|
|
|
Type=notify
|
2019-01-07 18:02:03 +00:00
|
|
|
#ExecStart=/usr/bin/traefik --configFile=/etc/traefik/traefik.toml
|
2016-11-08 11:25:56 +00:00
|
|
|
Restart=always
|
|
|
|
|
WatchdogSec=1s
|
2016-08-12 10:52:35 +00:00
|
|
|
|
2019-01-07 18:02:03 +00:00
|
|
|
# lock down system access
|
|
|
|
|
# prohibit any operating system and configuration modification
|
|
|
|
|
#ProtectSystem=strict
|
|
|
|
|
# create separate, new (and empty) /tmp and /var/tmp filesystems
|
|
|
|
|
#PrivateTmp=true
|
|
|
|
|
# make /home directories inaccessible
|
|
|
|
|
#ProtectHome=true
|
|
|
|
|
# turns off access to physical devices (/dev/...)
|
|
|
|
|
#PrivateDevices=true
|
|
|
|
|
# make kernel settings (procfs and sysfs) read-only
|
|
|
|
|
#ProtectKernelTunables=true
|
|
|
|
|
# make cgroups /sys/fs/cgroup read-only
|
|
|
|
|
#ProtectControlGroups=true
|
|
|
|
|
|
|
|
|
|
# allow writing of acme.json
|
|
|
|
|
#ReadWritePaths=/etc/traefik/acme.json
|
|
|
|
|
# depending on log and entrypoint configuration, you may need to allow writing to other paths, too
|
|
|
|
|
|
|
|
|
|
# limit number of processes in this unit
|
|
|
|
|
#LimitNPROC=1
|
|
|
|
|
|
2016-08-12 10:52:35 +00:00
|
|
|
[Install]
|
|
|
|
|
WantedBy=multi-user.target
|
