netmountcc.service

[Unit]
Description=Netmount File Transfer Service
After=network-online.target
Wants=network-online.target systemd-networkd-wait-online.service casket.service
; May or may not need casket for reverse proxying.

; Do not allow the process to be restarted in a tight loop. If the
; process fails to start, something critical needs to be fixed.
;
; Consider uncommenting this line if your systemd is new enough:
;StartLimitIntervalSec=14400
StartLimitBurst=10

[Service]
Restart=on-abnormal

; User and group the process will run as.
User=www-data
Group=www-data

WorkingDirectory=/var/www/netmount
; Create a symlink at /var/www/netmount to wherever the files are stored.

ExecStart=/usr/bin/node bin/index.js
; ExecReload=/bin/kill -USR1 $MAINPID

; Use graceful shutdown with a reasonable timeout
KillMode=mixed
KillSignal=SIGQUIT
TimeoutStopSec=5s

; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
LimitNOFILE=1048576
; Unmodified netmount is not expected to use more than that.
TasksMax=512

; Use private /tmp and /var/tmp, which are discarded after netmount stops.
PrivateTmp=true
; Use a minimal /dev (May bring additional security if switched to 'true', but it may not work on Raspberry Pi's or other devices, so it has been disabled in this dist.)
PrivateDevices=false
; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
ProtectHome=true
; Make /usr, /boot, /etc and possibly some more folders read-only.
ProtectSystem=full

; The following additional security directives only work with systemd v229 or later.
; They further restrict privileges that can be gained by netmount. Uncomment if you like.
;CapabilityBoundingSet=CAP_NET_BIND_SERVICE
;AmbientCapabilities=CAP_NET_BIND_SERVICE
;NoNewPrivileges=true

[Install]
WantedBy=multi-user.target