[email protected]

# multi-process systemd script
# https://github.com/nusenu/ansible-relayor/blob/master/templates/debian_tor%40.service

[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target

[Service]
Type = simple
ExecStartPre = /usr/bin/tor -f /etc/tor/tor%i.cfg --verify-config
ExecStart = /usr/bin/tor -f /etc/tor/tor%i.cfg --runasdaemon 0
ExecReload = /bin/kill -HUP ${MAINPID}
KillSignal = SIGINT
TimeoutSec = 30
Restart = on-failure
#WatchdogSec = 1m
LimitNOFILE = 32768


## Hardening
PrivateTmp = yes
PrivateDevices = yes
ProtectHome = yes
ProtectSystem = full
## disabled due to upstream systemd bug
## https://github.com/nusenu/ansible-relayor/issues/16
#ReadOnlyDirectories = /
#ReadWriteDirectories = /var/lib/tor/%i
#ReadWriteDirectories = /var/log/tor
#ReadWriteDirectories = /var/run/tor
NoNewPrivileges = yes
# CAP_DAC_OVERRIDE CAP_CHOWN is required for ControlSocket
# https://bugs.torproject.org/15659
# https://github.com/nusenu/ansible-relayor/issues/18
CapabilityBoundingSet = CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_CHOWN
PermissionsStartOnly=yes
AppArmorProfile=-system_tor

[Install]
WantedBy = multi-user.target