mirror of
https://github.com/GrapheneOS/infrastructure.git
synced 2025-11-25 09:13:06 -05:00
2caa67529a
This sets up the infrastructure for moving from storing nginx access logs in journald to plain text files written by syslog-ng and rotated by logrotate. This works around the poor performance, poor space efficiency and lack of archived log compression for journald. Unlike writing access logs directly with nginx, this continues avoiding blocking writes in the event loop and sticks to asynchronous sends through a socket. Since nginx only supports syslog via the RFC 3164 protocol rather than the more modern RFC 5424 protocol, this leaves formatting timestamps up to nginx rather than using the ones provided via the syslog protocol.
33 lines
825 B
Text
33 lines
825 B
Text
[Unit]
|
|
After=syslog-ng.service
|
|
|
|
[Service]
|
|
CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
NoNewPrivileges=true
|
|
PrivateIPC=true
|
|
ProcSubset=pid
|
|
ProtectClock=true
|
|
ProtectControlGroups=true
|
|
ProtectHome=true
|
|
ProtectHostname=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/nginx /var/log/nginx /var/cache/nginx
|
|
Restart=always
|
|
RestartMaxDelaySec=10s
|
|
RestartSec=100ms
|
|
RestartSteps=5
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
RuntimeDirectory=nginx
|
|
RuntimeDirectoryMode=700
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@obsolete
|