aboutsummaryrefslogtreecommitdiff
path: root/doc
diff options
context:
space:
mode:
authorAlex Auvolat <alex@adnab.me>2023-06-14 12:33:25 +0200
committerAlex Auvolat <alex@adnab.me>2023-06-14 12:39:46 +0200
commit120f8b3bfb61d1f38290207ac67933263cb57eeb (patch)
tree5fe340ede65ec47f5b261ec62229369b26180c8a /doc
parent39c3738a079f2a18ee1ef378c8f67050eb2f442b (diff)
downloadgarage-120f8b3bfb61d1f38290207ac67933263cb57eeb.tar.gz
garage-120f8b3bfb61d1f38290207ac67933263cb57eeb.zip
doc: better doc on systemd's DynamicUser (fix #430)
Diffstat (limited to 'doc')
-rw-r--r--doc/book/cookbook/systemd.md15
1 files changed, 14 insertions, 1 deletions
diff --git a/doc/book/cookbook/systemd.md b/doc/book/cookbook/systemd.md
index b271010b..c0ed7d1f 100644
--- a/doc/book/cookbook/systemd.md
+++ b/doc/book/cookbook/systemd.md
@@ -33,7 +33,20 @@ NoNewPrivileges=true
WantedBy=multi-user.target
```
-*A note on hardening: garage will be run as a non privileged user, its user id is dynamically allocated by systemd. It cannot access (read or write) home folders (/home, /root and /run/user), the rest of the filesystem can only be read but not written, only the path seen as /var/lib/garage is writable as seen by the service (mapped to /var/lib/private/garage on your host). Additionnaly, the process can not gain new privileges over time.*
+**A note on hardening:** Garage will be run as a non privileged user, its user
+id is dynamically allocated by systemd (set with `DynamicUser=true`). It cannot
+access (read or write) home folders (`/home`, `/root` and `/run/user`), the
+rest of the filesystem can only be read but not written, only the path seen as
+`/var/lib/garage` is writable as seen by the service. Additionnaly, the process
+can not gain new privileges over time.
+
+For this to work correctly, your `garage.toml` must be set with
+`metadata_dir=/var/lib/garage/meta` and `data_dir=/var/lib/garage/data`. This
+is mandatory to use the DynamicUser hardening feature of systemd, which
+autocreates these directories as virtual mapping. If the directory
+`/var/lib/garage` already exists before starting the server for the first time,
+the systemd service might not start correctly. Note that in your host
+filesystem, Garage data will be held in `/var/lib/private/garage`.
To start the service then automatically enable it at boot: