70ecd6caa0
Transaction Science open standards monorepo. Each subdirectory is a self-contained reference protocol with its own README and licence. - openpay/ Apache-2.0 payment-acceptance stack (Rust, 26 crates) - smart-byte/ CC-BY-4.0 content-addressed value carrier (spec) - eoc/ CC-BY-4.0 energy-optimised compute (spec) The wire format and the right to fork are public. The optional hosted services are the offer; the protocols are not.
70 lines
2.1 KiB
Desktop File
70 lines
2.1 KiB
Desktop File
# OpenPay — sample systemd unit.
|
|
#
|
|
# Install:
|
|
# sudo cp openpay.service /etc/systemd/system/openpay.service
|
|
# sudo cp openpay.env.sample /etc/openpay/openpay.env # edit first
|
|
# sudo useradd -r -s /usr/sbin/nologin -d /var/lib/openpay openpay
|
|
# sudo install -d -o openpay -g openpay -m 0750 /var/lib/openpay
|
|
# sudo install -d -o root -g openpay -m 0750 /etc/openpay
|
|
# sudo install -o root -g root -m 0755 \
|
|
# target/release/op-server /usr/local/bin/op-server
|
|
# sudo systemctl daemon-reload
|
|
# sudo systemctl enable --now openpay
|
|
#
|
|
# Tail logs:
|
|
# journalctl -u openpay -f
|
|
|
|
[Unit]
|
|
Description=OpenPay HTTP server (op-server)
|
|
Documentation=https://github.com/openpay/openpay/tree/main/docs/deploy
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=openpay
|
|
Group=openpay
|
|
WorkingDirectory=/var/lib/openpay
|
|
|
|
# Env vars the binary reads. OP_BIND_ADDR and RUST_LOG are the
|
|
# only two read by the shipped main.rs; OP_GRAPH_PATH, OP_API_KEYS,
|
|
# and OP_LOG_FORMAT are conventions this deploy guide adopts and
|
|
# assume a patched main.rs / custom binary (see README.md §3-4).
|
|
Environment=OP_BIND_ADDR=127.0.0.1:8080
|
|
Environment=OP_GRAPH_PATH=/var/lib/openpay/data.graph
|
|
EnvironmentFile=-/etc/openpay/openpay.env
|
|
|
|
ExecStart=/usr/local/bin/op-server
|
|
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
|
|
# Graceful shutdown: the binary installs Ctrl-C + SIGTERM handlers
|
|
# (see crates/op-server/src/main.rs::shutdown_signal). Give it a
|
|
# bit before SIGKILL so in-flight requests can drain.
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=30s
|
|
|
|
# Hardening. /var/lib/openpay is the only writable path the service
|
|
# needs — the .graph file lives there.
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadWritePaths=/var/lib/openpay
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
SystemCallArchitectures=native
|
|
|
|
# Resource limits. Tune to your traffic profile.
|
|
LimitNOFILE=65536
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|