RedXen
/
ansible-systemd
Archived
1
0
Fork 0
Code Issues 1 Pull Requests Releases Wiki Activity

Allow telegram to snoop on seedbox files, monitor the seedbox and increase the backend size for varnish

This commit is contained in:
Alex 2020-07-02 20:49:19 +02:00
parent 92c294fb46
commit f9bef95856
Signed by: caskd
GPG Key ID: F92BA85F61F4C173
3 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
templates/haproxy.service.j2
View File

@ -2,8 +2,8 @@
StartLimitIntervalSec=0 StartLimitIntervalSec=0
[Service] [Service]
User=varnish User={{ haproxy.user }}
Group=varnish Group={{ haproxy.group }}
Restart=on-failure Restart=on-failure
RestartSec=10 RestartSec=10

6
templates/telegraf.service.j2
View File

@ -13,6 +13,9 @@ ProtectSystem=strict
NoNewPrivileges=yes NoNewPrivileges=yes
TemporaryFileSystem=/:ro TemporaryFileSystem=/:ro
BindReadOnlyPaths=/etc/telegraf /usr /lib /lib64 /proc /sys BindReadOnlyPaths=/etc/telegraf /usr /lib /lib64 /proc /sys
{% if inventory_hostname == "n2" %}
BindReadOnlyPaths=/mnt/seedbox
{% endif %}
ProtectControlGroups=yes ProtectControlGroups=yes
ProtectKernelModules=yes ProtectKernelModules=yes
ProtectKernelTunables=yes ProtectKernelTunables=yes
@ -27,4 +30,7 @@ PrivateDevices=yes
{% if inventory_hostname == "n1" %} {% if inventory_hostname == "n1" %}
CapabilityBoundingSet=CAP_NET_ADMIN CapabilityBoundingSet=CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_ADMIN AmbientCapabilities=CAP_NET_ADMIN
{% elif inventory_hostname == "n2" %}
CapabilityBoundingSet=CAP_DAC_READ_SEARCH
AmbientCapabilities=CAP_DAC_READ_SEARCH
{% endif %} {% endif %}

2
templates/varnish.service.j2
View File

@ -8,4 +8,4 @@ RestartSec=10
CacheDirectory=varnish CacheDirectory=varnish
ExecStart= ExecStart=
ExecStart=/usr/sbin/varnishd -F -a {{ varnish.frontend.sock }},user={{ varnish.frontend.user }},group={{ varnish.frontend.group }},mode={{ varnish.frontend.mode }},PROXY -p feature=+http2 -p tcp_fastopen=on -j unix,user={{ varnish.jail.user }} -f /etc/varnish/default.vcl -s file,/var/cache/varnish/file,4G ExecStart=/usr/sbin/varnishd -F -a {{ varnish.frontend.sock }},user={{ varnish.frontend.user }},group={{ varnish.frontend.group }},mode={{ varnish.frontend.mode }},PROXY -p feature=+http2 -p tcp_fastopen=on -j unix,user={{ varnish.jail.user }} -f /etc/varnish/default.vcl -s file,/var/cache/varnish/file,10G