Initial commit: IT Nexus Web-App

nexus-scanner/nexus-scanner.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Nexus Network Scanner Agent
+Documentation=https://it-nexus.cereda-systems.de
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/nexus-scanner /etc/nexus-scanner/config.yaml
+Restart=on-failure
+RestartSec=10s
+User=nexus-scanner
+Group=nexus-scanner
+
+# Allow raw socket access for ARP (runs as non-root).
+AmbientCapabilities=CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_RAW
+
+# Hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadWritePaths=/var/lib/nexus-scanner
+
+# Logging — captured by journald.
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=nexus-scanner
+
+[Install]
+WantedBy=multi-user.target