update

2026-08-16 22:47:26 -07:00
parent b3212235db
commit ca0f89a671
12 changed files with 1431 additions and 0 deletions
@@ -0,0 +1,43 @@
+[Unit]
+Description=BookStack MCP Server
+Documentation=https://github.com/your/bookstack-mcp
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=exec
+User=bookstack-mcp
+Group=bookstack-mcp
+
+EnvironmentFile=/etc/bookstack-mcp/env
+WorkingDirectory=/opt/bookstack-mcp
+ExecStart=/opt/bookstack-mcp/venv/bin/python -m bookstack_mcp
+
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=20s
+
+# --- Hardening ---
+# These all work in an unprivileged Proxmox/LXD container. If the service fails
+# with a 226/NAMESPACE or 227/SECCOMP status on an older kernel, comment out the
+# block below and it will start fine -- it only reduces defence in depth.
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+# Journald captures stdout/stderr: journalctl -u bookstack-mcp -f
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=bookstack-mcp
+
+[Install]
+WantedBy=multi-user.target