2023-08-22 11:57:59 +00:00
|
|
|
[Unit]
|
|
|
|
|
Description=Tailscale node agent
|
|
|
|
|
Documentation=https://tailscale.com/kb/
|
|
|
|
|
Wants=network-pre.target
|
|
|
|
|
After=network-pre.target NetworkManager.service systemd-resolved.service
|
|
|
|
|
|
|
|
|
|
[Service]
|
|
|
|
|
EnvironmentFile=/etc/default/tailscaled
|
|
|
|
|
ExecStartPre=/usr/sbin/tailscaled --cleanup
|
|
|
|
|
ExecStart=/usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port=${PORT} $FLAGS
|
|
|
|
|
ExecStopPost=/usr/sbin/tailscaled --cleanup
|
|
|
|
|
Restart=on-failure
|
|
|
|
|
RuntimeDirectory=tailscale
|
|
|
|
|
RuntimeDirectoryMode=0755
|
|
|
|
|
StateDirectory=tailscale
|
|
|
|
|
StateDirectoryMode=0700
|
|
|
|
|
CacheDirectory=tailscale
|
|
|
|
|
CacheDirectoryMode=0750
|
|
|
|
|
Type=notify
|
2023-08-22 13:34:21 +00:00
|
|
|
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
2024-02-20 14:50:20 +00:00
|
|
|
PrivateDevices=true
|
|
|
|
|
ProtectClock=true
|
|
|
|
|
ProtectControlGroups=true
|
2023-08-22 13:34:21 +00:00
|
|
|
ProtectHome=true
|
|
|
|
|
ProtectHostname=true
|
|
|
|
|
ProtectKernelLogs=true
|
2024-02-20 14:50:20 +00:00
|
|
|
ProtectKernelModules=true
|
|
|
|
|
ProtectKernelTunables=true
|
2023-08-22 13:34:21 +00:00
|
|
|
RestrictRealtime=true
|
2024-02-20 14:50:20 +00:00
|
|
|
# give permission to TUN
|
|
|
|
|
BindPaths=/dev/net/tun
|
|
|
|
|
DeviceAllow=/dev/net/tun rw
|
2023-08-22 11:57:59 +00:00
|
|
|
|
|
|
|
|
[Install]
|
|
|
|
|
WantedBy=multi-user.target
|
