AAA
1332473513
Rename the active product, Go module, binaries, configuration, protocols and documentation to Piik while retaining the TV mascot and existing media/room behavior. Use one current private contract without old-name aliases. Preserve SQLite authority and copy compatible local settings once; other settings start fresh. Git-message cleanup and the infrastructure name cutover are coordinated with this phase, with original history and deployment data archived externally. Validated locally with Web and Go checks, Windows capture compilation, matched Client/Server builds, packaged Client control handshake and history-rewrite integrity checks. Skip duplicate hosted CI for this owner-authorized local release. [skip ci]
46 lines
1.0 KiB
Plaintext
46 lines
1.0 KiB
Plaintext
[Unit]
|
|
Description=Piik web, signaling, STUN and SFU application
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=piik
|
|
Group=piik
|
|
WorkingDirectory=/opt/piik/current
|
|
Environment=PIIK_ENV=production
|
|
Environment=ROOM_DATABASE_PATH=/var/lib/piik/rooms.sqlite
|
|
EnvironmentFile=/etc/piik/piik.env
|
|
ExecStart=/opt/piik/current/piik-server
|
|
Restart=on-failure
|
|
RestartSec=3s
|
|
TimeoutStopSec=20s
|
|
UMask=0077
|
|
StateDirectory=piik
|
|
StateDirectoryMode=0700
|
|
LogsDirectory=piik
|
|
LogsDirectoryMode=0700
|
|
|
|
NoNewPrivileges=true
|
|
PrivateDevices=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectControlGroups=true
|
|
ProtectClock=true
|
|
ProtectHostname=true
|
|
# Pion uses Go's net.Interfaces, which queries Linux through NETLINK_ROUTE.
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
CapabilityBoundingSet=
|
|
SystemCallArchitectures=native
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|