confluent/confluent_server/systemd/confluent.service

# IBM(c) 2015 Apache 2.0
# Lenovo(c) 2020 Apache 2.0
[Unit]
Description=Confluent hardware manager

[Service]
Type=forking
#PIDFile=/var/run/confluent/pid
RuntimeDirectory=confluent
CacheDirectory=confluent
LogsDirectory=confluent
ConfigurationDirectory=confluent
ExecStart=/opt/confluent/bin/confluent
ExecStop=/opt/confluent/bin/confetty shutdown /
Restart=on-failure
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID CAP_CHOWN CAP_NET_RAW
User=confluent
Group=confluent
#DevicePolicy=closed # fuse filesystem requires us to interact with /dev/fuse
ProtectControlGroups=true
ProtectSystem=true

[Install]
WantedBy=multi-user.target
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 13:33:47 -04:00			`# IBM(c) 2015 Apache 2.0`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 09:52:52 -05:00			`# Lenovo(c) 2020 Apache 2.0`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 13:33:47 -04:00			`[Unit]`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 09:52:52 -05:00			`Description=Confluent hardware manager`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 13:33:47 -04:00
			`[Service]`
			`Type=forking`
Change systemd unit to not have PIDFile systemctl restart always prints a worrying message with pidfile. 2018-09-07 11:27:43 -04:00			`#PIDFile=/var/run/confluent/pid`
Have systemd manage confluent run dir The run directory has to be created and owned by confluent, or else things cannot start. 2020-02-06 13:45:46 -05:00			`RuntimeDirectory=confluent`
			`CacheDirectory=confluent`
			`LogsDirectory=confluent`
			`ConfigurationDirectory=confluent`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 13:33:47 -04:00			`ExecStart=/opt/confluent/bin/confluent`
Prevent hang on systemctl stop confluent systemd's default stop seems to be incapable of understanding how to shut down our service. Provide an explicit ExecStop to have systemd act more sanely. 2015-11-02 14:11:07 -05:00			`ExecStop=/opt/confluent/bin/confetty shutdown /`
Correct some minor potential issues and add restart on failure 2017-08-25 16:41:22 -04:00			`Restart=on-failure`
Add RAW capability to the service This is required for the new PXE support 2020-03-20 14:59:30 -04:00			`AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID CAP_CHOWN CAP_NET_RAW`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 09:52:52 -05:00			`User=confluent`
			`Group=confluent`
Relax systemd device policy to allow /dev/fuse access 2024-01-26 09:24:41 -05:00			`#DevicePolicy=closed # fuse filesystem requires us to interact with /dev/fuse`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 09:52:52 -05:00			`ProtectControlGroups=true`
			`ProtectSystem=true`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 13:33:47 -04:00
			`[Install]`
			`WantedBy=multi-user.target`