Ronni Baslund
9d075343c5
ci / typecheck (map[dir:apps/booking name:booking]) (push) Has been cancelled
ci / typecheck (map[dir:apps/portal name:portal]) (push) Has been cancelled
ci / typecheck (map[dir:apps/website name:website]) (push) Has been cancelled
ci / typecheck (map[dir:services/platform-api name:platform-api]) (push) Has been cancelled
ci / test (push) Has been cancelled
v0.16 dropped TOML config. The host service now boots from a tiny config.json that describes only the datastore (RocksDB); all other settings live in the DB (web UI / stalwart-cli / platform-api JMAP). - add stalwart/config.json (RocksDb datastore at /opt/stalwart/data) - install.sh: install config.json instead of config.toml - stalwart-mail.service: --config points at config.json - README: document the v0.16 model + remaining DB-side config + DNS/PTR Verified: Stalwart 0.16.8 runs on node1 with default mail listeners + the :8080 management server. config.toml retained as a reference for the DB settings.
40 lines
1.2 KiB
Desktop File
40 lines
1.2 KiB
Desktop File
# Dezky — Stalwart mail server (bare-metal host service).
|
|
#
|
|
# Secrets (admin password, webhook secret) come from the EnvironmentFile, which
|
|
# install.sh generates from config.env. The binary needs CAP_NET_BIND_SERVICE
|
|
# to bind the privileged mail ports (25/143/...) while running as a non-root user.
|
|
|
|
[Unit]
|
|
Description=Stalwart Mail Server (Dezky)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=stalwart
|
|
Group=stalwart
|
|
EnvironmentFile=/opt/stalwart/etc/stalwart.env
|
|
ExecStart=/opt/stalwart/bin/stalwart --config /opt/stalwart/etc/config.json
|
|
# Stalwart reloads its TLS certs / config on SIGHUP — used by cert-sync.
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
LimitNOFILE=65536
|
|
|
|
# Bind privileged ports without full root
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
|
|
# Hardening — Stalwart only needs to write under /opt/stalwart
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
ReadWritePaths=/opt/stalwart/data /opt/stalwart/logs /opt/stalwart/etc/tls
|
|
ProtectKernelTunables=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|