57 lines
1.8 KiB
SYSTEMD
57 lines
1.8 KiB
SYSTEMD
|
# systemd unit for the @dgb-wallet/p2p HTTP daemon on a wallet VPS.
|
|||
|
|
# Ships with digibyte.x — Caddy reverse-proxies /p2p/ here.
|
|||
|
|
#
|
|||
|
|
# Prereqs (all provisioned by ops/deploy-wallet.sh):
|
|||
|
|
# - /opt/dgb-wallet/ contains the monorepo checkout (or at minimum
|
|||
|
|
# packages/{core,p2p,net}/ + workspace root)
|
|||
|
|
# - Node 20+ installed as /usr/bin/node
|
|||
|
|
# - `npm install` already run at /opt/dgb-wallet/ so node_modules
|
|||
|
|
# is populated
|
|||
|
|
# - dgb-wallet user owns /opt/dgb-wallet and /var/lib/dgb-wallet
|
|||
|
|
#
|
|||
|
|
# The daemon binds 127.0.0.1:5174 only. It is NOT reachable from the
|
|||
|
|
# public internet directly; Caddy on 443 fronts it via /p2p/*.
|
|||
|
|
|
|||
|
|
[Unit]
|
|||
|
|
Description=DigiByte.X Wallet P2P Daemon (BIP157/158 SPV + broadcast)
|
|||
|
|
Documentation=https://digibyte.x
|
|||
|
|
After=network-online.target
|
|||
|
|
Wants=network-online.target
|
|||
|
|
|
|||
|
|
[Service]
|
|||
|
|
Type=simple
|
|||
|
|
User=dgb-wallet
|
|||
|
|
Group=dgb-wallet
|
|||
|
|
WorkingDirectory=/opt/dgb-wallet
|
|||
|
|
|
|||
|
|
# 8 GB heap ceiling — the header chain (~7.8M entries × 80 B + JS
|
|||
|
|
# overhead) sits around 3-4 GB in steady state; leave headroom for
|
|||
|
|
# scan bursts. Match packages/p2p/package.json's daemon script.
|
|||
|
|
Environment="NODE_OPTIONS=--max-old-space-size=8192"
|
|||
|
|
|
|||
|
|
ExecStart=/usr/bin/node --import tsx/esm packages/p2p/bin/dgb-daemon.ts
|
|||
|
|
Restart=on-failure
|
|||
|
|
RestartSec=5s
|
|||
|
|
|
|||
|
|
# Hardening — daemon reads/writes only its data dir and its checkout.
|
|||
|
|
NoNewPrivileges=true
|
|||
|
|
ProtectSystem=strict
|
|||
|
|
ProtectHome=true
|
|||
|
|
PrivateTmp=true
|
|||
|
|
ProtectKernelTunables=true
|
|||
|
|
ProtectKernelModules=true
|
|||
|
|
ProtectControlGroups=true
|
|||
|
|
ReadWritePaths=/var/lib/dgb-wallet
|
|||
|
|
Environment="APPDATA=/var/lib/dgb-wallet"
|
|||
|
|
|
|||
|
|
# Kill on OOM rather than let systemd escalate to the whole slice.
|
|||
|
|
OOMScoreAdjust=500
|
|||
|
|
|
|||
|
|
# Journal so `journalctl -u dgb-daemon -f` shows peer connect/disconnect
|
|||
|
|
# and scan telemetry.
|
|||
|
|
StandardOutput=journal
|
|||
|
|
StandardError=journal
|
|||
|
|
|
|||
|
|
[Install]
|
|||
|
|
WantedBy=multi-user.target
|