confluent/confluent_server/systemd/confluent.service

# IBM(c) 2015 Apache 2.0
# Lenovo(c) 2020 Apache 2.0
[Unit]
Description=Confluent hardware manager

[Service]
Type=forking
#PIDFile=/var/run/confluent/pid
RuntimeDirectory=confluent
StateDirectory=confluent
CacheDirectory=confluent
LogsDirectory=confluent
ConfigurationDirectory=confluent
ExecStart=/opt/confluent/bin/confluent
ExecStop=/opt/confluent/bin/confetty shutdown /
Restart=on-failure
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID CAP_CHOWN
User=confluent
Group=confluent
DevicePolicy=closed
ProtectControlGroups=true
ProtectSystem=true

[Install]
WantedBy=multi-user.target
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00			`# IBM(c) 2015 Apache 2.0`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 14:52:52 +00:00			`# Lenovo(c) 2020 Apache 2.0`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00			`[Unit]`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 14:52:52 +00:00			`Description=Confluent hardware manager`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00
			`[Service]`
			`Type=forking`
Change systemd unit to not have PIDFile systemctl restart always prints a worrying message with pidfile. 2018-09-07 15:27:43 +00:00			`#PIDFile=/var/run/confluent/pid`
Have systemd manage confluent run dir The run directory has to be created and owned by confluent, or else things cannot start. 2020-02-06 18:45:46 +00:00			`RuntimeDirectory=confluent`
			`StateDirectory=confluent`
			`CacheDirectory=confluent`
			`LogsDirectory=confluent`
			`ConfigurationDirectory=confluent`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00			`ExecStart=/opt/confluent/bin/confluent`
Prevent hang on systemctl stop confluent systemd's default stop seems to be incapable of understanding how to shut down our service. Provide an explicit ExecStop to have systemd act more sanely. 2015-11-02 19:11:07 +00:00			`ExecStop=/opt/confluent/bin/confetty shutdown /`
Correct some minor potential issues and add restart on failure 2017-08-25 20:41:22 +00:00			`Restart=on-failure`
Leverage unix_chkpwd If doing PAM authentication, we can setuid to the target user and then pam_unix will use unix_chkpwd on our behalf. Problems with this working in the lab was resolved by a yum reinstall pam, so it was presumably due to messed up setcap or similar experiments. 2020-02-13 15:37:15 +00:00			`AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID CAP_CHOWN`
Change confluent to run as non-root and harden systemd This mitigates a great deal of risk compared to prior behavior. 2020-01-31 14:52:52 +00:00			`User=confluent`
			`Group=confluent`
			`DevicePolicy=closed`
			`ProtectControlGroups=true`
			`ProtectSystem=true`
Add simple systemd service file for confluent server. The sysvinit scripts were not returning the same informational messages when run under systemctl as they were when run under service. 2015-07-15 17:33:47 +00:00
			`[Install]`
			`WantedBy=multi-user.target`