confluent/confluent_server/systemd/confluent.service

# IBM(c) 2015 Apache 2.0
# Lenovo(c) 2020 Apache 2.0
[Unit]
Description=Confluent hardware manager

[Service]
Type=forking
#PIDFile=/var/run/confluent/pid
ExecStart=/opt/confluent/bin/confluent
ExecStop=/opt/confluent/bin/confetty shutdown /
Restart=on-failure
AmbientCapabilities=CAP_NET_BIND_SERVICE
User=confluent
Group=confluent
DevicePolicy=closed
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
PrivateDevices=true
ProtectControlGroups=true
ProtectSystem=true

[Install]
WantedBy=multi-user.target
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00			`# IBM(c) 2015 Apache 2.0`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 14:52:52 +00:00			`# Lenovo(c) 2020 Apache 2.0`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00			`[Unit]`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 14:52:52 +00:00			`Description=Confluent hardware manager`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00
			`[Service]`
			`Type=forking`
Change systemd unit to not have PIDFile systemctl restart always prints a worrying message with pidfile. 2018-09-07 15:27:43 +00:00			`#PIDFile=/var/run/confluent/pid`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00			`ExecStart=/opt/confluent/bin/confluent`
Prevent hang on systemctl stop confluent systemd's default stop seems to be incapable of understanding how to shut down our service. Provide an explicit ExecStop to have systemd act more sanely. 2015-11-02 19:11:07 +00:00			`ExecStop=/opt/confluent/bin/confetty shutdown /`
Correct some minor potential issues and add restart on failure 2017-08-25 20:41:22 +00:00			`Restart=on-failure`
Add CAP_NET_BIND_SERVICE to unit file This is preparing for running as non-root. We need this capability to snoop SLP and PXE 2020-01-31 14:34:13 +00:00			`AmbientCapabilities=CAP_NET_BIND_SERVICE`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 14:52:52 +00:00			`User=confluent`
			`Group=confluent`
			`DevicePolicy=closed`
			`CapabilityBoundingSet=CAP_NET_BIND_SERVICE`
			`PrivateDevices=true`
			`ProtectControlGroups=true`
			`ProtectSystem=true`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00
			`[Install]`
			`WantedBy=multi-user.target`