pyrtan / sourcev0.19.0 · main

pyrtan / deploy / systemd / pyrtan-demo.service

1,168 bytes · last changed 2026-10-25 in Initial public release

1# Pyrtan demo as one systemd service, without Docker: a single process
2# holding every example tree, serving the demo page on port 8701.
3#
4# sudo cp pyrtan-demo.service /etc/systemd/system/
5# sudo systemctl daemon-reload && sudo systemctl enable --now pyrtan-demo
6#
7# Assumes pyrtan was installed under /opt/pyrtan as deploy/README.md
8# describes, so the command lives at /opt/pyrtan/bin/pyrtan. Trees are read
9# from /var/lib/pyrtan/trees; edit TREES to taste.
10
11[Unit]
12Description=Pyrtan demo swarm (single process)
13After=network-online.target
14Wants=network-online.target
15
16[Service]
17Type=simple
18User=pyrtan
19Group=pyrtan
20Environment=PYTHONUNBUFFERED=1
21Environment=TREES=/var/lib/pyrtan/trees
22ExecStart=/opt/pyrtan/bin/pyrtan serve ${TREES} --host 0.0.0.0 --port 8701 --name demo
23Restart=on-failure
24RestartSec=3
25# Hardening: the process needs the network and read access to its trees, nothing else.
26NoNewPrivileges=true
27ProtectSystem=strict
28ProtectHome=true
29ReadOnlyPaths=/opt/pyrtan /var/lib/pyrtan
30PrivateTmp=true
31ProtectKernelTunables=true
32ProtectControlGroups=true
33RestrictSUIDSGID=true
34LockPersonality=true
35MemoryMax=256M
36
37[Install]
38WantedBy=multi-user.target