From 236d813994acd076ce96d764d569ee6bb3da98f9 Mon Sep 17 00:00:00 2001
From: Stonewall Jackson <stonewall@sacredheartsc.com>
Date: Wed, 31 May 2023 21:35:04 -0400
Subject: add synapse role

---
 .../etc/systemd/system/synapse.service.j2          | 42 ++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 roles/synapse/templates/etc/systemd/system/synapse.service.j2

(limited to 'roles/synapse/templates/etc')

diff --git a/roles/synapse/templates/etc/systemd/system/synapse.service.j2 b/roles/synapse/templates/etc/systemd/system/synapse.service.j2
new file mode 100644
index 0000000..84ab9f3
--- /dev/null
+++ b/roles/synapse/templates/etc/systemd/system/synapse.service.j2
@@ -0,0 +1,42 @@
+[Unit]
+Description=Synapse Matrix Homeserver
+Documentation=https://github.com/matrix-org/synapse
+Wants=gssproxy.service
+After=network-online.target nss-user-lookup.target gssproxy.service
+
+[Service]
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+DevicePolicy=closed
+ProtectSystem=strict
+ProtectHome=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+ReadWritePaths={{ synapse_home }}
+
+User={{ synapse_user }}
+Group={{ synapse_user }}
+
+Type=notify
+NotifyAccess=main
+WorkingDirectory={{ synapse_home }}
+Environment=GSS_USE_PROXY=yes
+EnvironmentFile=-/etc/sysconfig/synapse
+
+ExecStart={{ synapse_venv }}/bin/python -m synapse.app.homeserver --config-path={{ synapse_home }}/homeserver.yaml
+ExecReload=/bin/kill -HUP $MAINPID
+
+Restart=always
+RestartSec=3
+
+SyslogIdentifier=synapse
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit