From 06bfc41a5ce11b42040a4234c938582f1fab320e Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 4 Jun 2024 23:42:17 +0200
Subject: install coredns to ch-iot

---
 roles/network/coredns/templates/coredns.service.j2 | 32 ++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 roles/network/coredns/templates/coredns.service.j2

(limited to 'roles/network/coredns/templates')

diff --git a/roles/network/coredns/templates/coredns.service.j2 b/roles/network/coredns/templates/coredns.service.j2
new file mode 100644
index 00000000..327f930b
--- /dev/null
+++ b/roles/network/coredns/templates/coredns.service.j2
@@ -0,0 +1,32 @@
+[Unit]
+Description=Coredns
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Restart=always
+User=coredns
+ExecStart=/usr/bin/coredns -conf /etc/coredns/Corefile
+ExecReload=/bin/kill -USR1 $MAINPID
+
+# systemd hardening-options
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+DeviceAllow=/dev/null rw
+DevicePolicy=strict
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.3