summaryrefslogtreecommitdiff
path: root/debian/openvpn@.service
diff options
context:
space:
mode:
authorBernhard Schmidt <berni@debian.org>2017-06-30 15:39:48 +0200
committerBernhard Schmidt <berni@debian.org>2017-06-30 15:39:48 +0200
commit5fe7875501a2560542b462f9af5bb3346214147f (patch)
tree3d7dd77a282ed10ce7d06932ba404569f2e901b2 /debian/openvpn@.service
parenta337e898bf9538be09e13cf50954df1cd4dc5815 (diff)
Adjust debian openvpn@.service
Adjust openvpn@.service to be similar to the upstream openvpn-server@,service In detail: * Adjust Documentation URL to OpenVPN 2.4 * use systemd READY signalling (Type=notify) * add ProtectHome=true * Add After/Wants network-online.target, this should fix a few bugs happening due to OpenVPN starting too early * adjust CapabililtyBoundingSet Closes: #858558, #864031
Diffstat (limited to 'debian/openvpn@.service')
-rw-r--r--debian/openvpn@.service16
1 files changed, 8 insertions, 8 deletions
diff --git a/debian/openvpn@.service b/debian/openvpn@.service
index a5e645f..53ff5a5 100644
--- a/debian/openvpn@.service
+++ b/debian/openvpn@.service
@@ -3,25 +3,25 @@ Description=OpenVPN connection to %i
PartOf=openvpn.service
ReloadPropagatedFrom=openvpn.service
Before=systemd-user-sessions.service
+After=syslog.target network-online.target
+Wants=network-online.target
Documentation=man:openvpn(8)
-Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
+Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
[Service]
+Type=notify
PrivateTmp=true
-KillMode=mixed
-Type=forking
+WorkingDirectory=/etc/openvpn
ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
PIDFile=/run/openvpn/%i.pid
ExecReload=/bin/kill -HUP $MAINPID
-WorkingDirectory=/etc/openvpn
-ProtectSystem=yes
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
+CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
+ProtectSystem=true
+ProtectHome=true
[Install]
WantedBy=multi-user.target
-
-