| 1 | # SPDX-License-Identifier: GPL-3.0-or-later |
| 2 | [Unit] |
| 3 | Description=Netdata, X-Ray Vision for your infrastructure! |
| 4 | |
| 5 | # append here other services you want netdata to wait for them to start |
| 6 | After=systemd-tmpfiles-setup.service network.target network-online.target nss-lookup.target |
| 7 | Wants=systemd-tmpfiles-setup.service network-online.target nss-lookup.target |
| 8 | |
| 9 | [Service] |
| 10 | LogNamespace=netdata |
| 11 | Type=simple |
| 12 | User=root |
| 13 | Group=netdata |
| 14 | RuntimeDirectory=netdata |
| 15 | RuntimeDirectoryMode=0775 |
| 16 | PIDFile=/run/netdata/netdata.pid |
| 17 | ExecStart=@sbindir_POST@/netdata -P /run/netdata/netdata.pid -D |
| 18 | PermissionsStartOnly=true |
| 19 | |
| 20 | # saving a big db on slow disks may need some time |
| 21 | TimeoutStopSec=150 |
| 22 | |
| 23 | # restart netdata if it crashes |
| 24 | Restart=on-failure |
| 25 | RestartSec=30 |
| 26 | |
| 27 | # Valid policies: other (the system default) | batch | idle | fifo | rr |
| 28 | # To give netdata the max priority, set CPUSchedulingPolicy=rr and CPUSchedulingPriority=99 |
| 29 | CPUSchedulingPolicy=batch |
| 30 | |
| 31 | # This sets the scheduling priority (for policies: rr and fifo). |
| 32 | # Priority gets values 1 (lowest) to 99 (highest). |
| 33 | #CPUSchedulingPriority=1 |
| 34 | |
| 35 | # For scheduling policy 'other' and 'batch', this sets the lowest niceness of netdata (-20 highest to 19 lowest). |
| 36 | Nice=0 |
| 37 | |
| 38 | # Capabilities |
| 39 | # is required for freeipmi and slabinfo plugins |
| 40 | CapabilityBoundingSet=CAP_DAC_OVERRIDE |
| 41 | # is required for apps plugin |
| 42 | CapabilityBoundingSet=CAP_DAC_READ_SEARCH |
| 43 | # is required for freeipmi plugin |
| 44 | CapabilityBoundingSet=CAP_FOWNER CAP_SYS_RAWIO |
| 45 | # is required for apps, perf and slabinfo plugins |
| 46 | CapabilityBoundingSet=CAP_SETPCAP |
| 47 | # is required for perf plugin |
| 48 | CapabilityBoundingSet=CAP_SYS_ADMIN CAP_PERFMON |
| 49 | # is required for apps plugin |
| 50 | CapabilityBoundingSet=CAP_SYS_PTRACE |
| 51 | # is required for ebpf plugin |
| 52 | CapabilityBoundingSet=CAP_SYS_RESOURCE |
| 53 | # is required for go.d/ping app |
| 54 | CapabilityBoundingSet=CAP_NET_RAW |
| 55 | # is required for cgroups plugin |
| 56 | CapabilityBoundingSet=CAP_SYS_CHROOT |
| 57 | # is required for nfacct plugin (bandwidth accounting) |
| 58 | CapabilityBoundingSet=CAP_NET_ADMIN |
| 59 | # is required for plugins that use sudo |
| 60 | CapabilityBoundingSet=CAP_SETGID CAP_SETUID |
| 61 | # is required to change file ownership |
| 62 | CapabilityBoundingSet=CAP_CHOWN |
| 63 | |
| 64 | # Sandboxing |
| 65 | ProtectSystem=full |
| 66 | ProtectHome=read-only |
| 67 | # PrivateTmp break netdatacli functionality. See - https://github.com/netdata/netdata/issues/7587 |
| 68 | #PrivateTmp=true |
| 69 | ProtectControlGroups=on |
| 70 | # We whitelist this because it's the standard location to listen on a UNIX socket. |
| 71 | ReadWriteDirectories=/run/netdata |
| 72 | # This is needed to make email-based alert deliver work if Postfix is the email provider on the system. |
| 73 | ReadWriteDirectories=-/var/spool/postfix/maildrop |
| 74 | # LXCFS directories (https://github.com/lxc/lxcfs#lxcfs) |
| 75 | # If we don't set them explicitly, systemd mounts procfs from the host. See https://github.com/netdata/netdata/issues/14238. |
| 76 | BindReadOnlyPaths=-/proc/cpuinfo -/proc/diskstats -/proc/loadavg -/proc/meminfo |
| 77 | BindReadOnlyPaths=-/proc/stat -/proc/swaps -/proc/uptime -/proc/slabinfo |
| 78 | |
| 79 | [Install] |
| 80 | WantedBy=multi-user.target |