panicmode/panicmode.service at main · BorisYamp/panicmode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
[Unit]
Description=PanicMode — server monitoring and incident response
Documentation=https://github.com/BorisYamp/panicmode
After=network-online.target
Wants=network-online.target
# Start after syslog so that log forwarding is available
After=syslog.target

[Service]
Type=simple
ExecStart=/usr/local/bin/panicmode /etc/panicmode/config.yaml
Restart=on-failure
RestartSec=5s

# Run as root — required for:
#   - Reading /proc/<pid>/fd (process monitoring)
#   - Sending SIGSTOP/SIGCONT to arbitrary processes
#   - Managing iptables rules (BlockIp action)
User=root
Group=root

# Working directory
WorkingDirectory=/var/lib/panicmode

# Runtime dir for the ctl Unix socket. systemd creates /run/panicmode at
# start with the requested mode and tears it down on stop, so a stale
# socket from a crash never blocks a restart with EADDRINUSE.
RuntimeDirectory=panicmode
RuntimeDirectoryMode=0700

# Environment
Environment=RUST_LOG=panicmode=info

# ─── Hardening (keep what root actually needs) ────────────────────────────────

# Prevent privilege escalation via execve
NoNewPrivileges=true

# Private /tmp
PrivateTmp=true

# Read-only file system except where we need to write.
# /run is required because UFW (when used as the firewall script backend)
# takes a lock at /run/ufw.lock, and iptables uses /run/xtables.lock.
# Without it, block_ip script calls fail under hardening.
ReadOnlyPaths=/
ReadWritePaths=/var/lib/panicmode /var/log/panicmode /etc/panicmode /tmp /run

# Allow network access (alerts via HTTP/SMTP/Telegram etc.).
# AF_NETLINK is required for iptables/ip6tables, which talk to kernel
# netfilter via netlink sockets. Without it, block_ip and unblock_ip
# scripts cannot modify firewall rules from inside the unit.
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK

# Restrict dangerous syscalls
SystemCallFilter=@system-service @process @network-io @file-system
SystemCallFilter=~@reboot @swap @mount
SystemCallErrorNumber=EPERM

# Limit resource usage
LimitNOFILE=65536
LimitNPROC=512
MemoryMax=256M
CPUQuota=10%

# Kill entire process group on stop
KillMode=control-group
TimeoutStopSec=15s

[Install]
WantedBy=multi-user.target