diff --git a/docs/docs/systemd.md b/docs/docs/systemd.md index 8d7c783..eac05ef 100644 --- a/docs/docs/systemd.md +++ b/docs/docs/systemd.md @@ -1,7 +1,24 @@ -unit systemd con utente dinamico: - - no adduser/altre conf - - utente con pochi permessi - - accesso consentito al gruppo adm +## A simple start + +The bare minimum you need to get circologd on a systemd-based system is this unit. +Other options with more features or more security are provided below + + [Unit] + Description=In-memory logging + + [Service] + User=root + Group=adm + ExecStart=/usr/local/sbin/circologd -syslogd-socket /run/circolog/syslog.sock -buffer-size 2000 -query-socket /run/circolog/query.sock + + [Install] + WantedBy=multi-user.target + + +## A better unit + +This is another unit, which has several security features, such as `DynamicUser`, filesystem restrictions, and +more. [Unit] Description=In-memory logging @@ -27,3 +44,29 @@ unit systemd con utente dinamico: [Install] WantedBy=multi-user.target +## Journald + +None of those are integrated with journald, however. The simplest way to integrate with journald is the +following. + +First of all, ensure `ForwardToSyslog=yes` in `/etc/systemd/journald.conf`. +Then, you need to run circologd as root and bind it [to a special +address](https://www.freedesktop.org/software/systemd/man/journald.conf.html#Forwarding%20to%20traditional%20syslog%20daemons). +Ok, you don't strictly _need_ to run it as root, but that's the easiest way to run it. +Here is a working unit for this: + + [Unit] + Description=In-memory logging + + [Service] + User=root + Group=adm + ExecStart=/usr/local/sbin/circologd -syslogd-socket /run/systemd/journal/syslog -buffer-size 2000 -query-socket /run/circolog/query.sock + + [Install] + WantedBy=multi-user.target + +### journald with socket activation + +To run circologd as non-root, while listening on a root-owned socket (`/run/systemd/journal/syslog`) use +socket activation