mirror of
https://github.com/shadowsocks/shadowsocks-rust.git
synced 2026-10-12 02:22:26 +00:00
Klaaktu
e33daa7114
* systemd: Use network-online.target for server Fixes #2186 ss-server needs to wait for the network to be up to be able to bind to non-wildcard IPs. Interface is configured at `network-online.target` but not at `network.target`. ss-local unit is kept the same, with `After=network.target` for proper ordering at shutdown - unit is stopped before network is shutdown. * systemd unit: improvements `exec` is [recommended](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Type=). Add `NoNewPriviledges` which has been used in [Arch packaging](https://gitlab.archlinux.org/archlinux/packaging/packages/shadowsocks-rust/-/blob/main/shadowsocks-rust-server%40.service?ref_type=heads). Add `CAP_NET_ADMIN` in ss-local which is needed for TUN mode. Removed `CAP_NET_BIND_SERVICE` from ss-local. Do you really need to bind to priviledged port in *client*? Debian unit left un-hardened. I'm not sure why it's different from the other ss-server unit.