spb/internetpressure

1# InternetPressure.io probe agent — systemd unit (Linux).2# Installed by deploy/install.sh to /etc/systemd/system/ip-probe.service.3#4# ICMP without root: the agent opens an unprivileged ICMP datagram socket, which Linux only allows for groups5# inside net.ipv4.ping_group_range. The installer writes /etc/sysctl.d/60-ip-probe.conf with6#   net.ipv4.ping_group_range = 0 21474836477# so no capability is required. Without it the agent falls back to TCP-connect "ping" (kind "tcp").8# Alternative (not recommended): uncomment AmbientCapabilities below to grant CAP_NET_RAW instead.9#10# traceroute: the system `traceroute` binary (UDP probes) must be installed (apt install traceroute /11# dnf install traceroute). Modern traceroute needs no root for UDP probes when ping_group_range is set;12# otherwise the binary is usually setuid or has file capabilities set by the distribution.1314[Unit]15Description=InternetPressure.io probe agent16Documentation=https://www.internetpressure.io/probes17After=network-online.target18Wants=network-online.target1920[Service]21Type=simple22User=ip-probe23Group=ip-probe24DynamicUser=no25ExecStart=/usr/local/bin/ip-probe run --config /etc/internetpressure/probe.yaml26WorkingDirectory=/var/lib/internetpressure27Restart=always28RestartSec=529TimeoutStopSec=1530KillSignal=SIGTERM3132# Uncomment to use raw sockets instead of net.ipv4.ping_group_range (not needed when the sysctl is set):33#AmbientCapabilities=CAP_NET_RAW34#CapabilityBoundingSet=CAP_NET_RAW3536# Hardening37NoNewPrivileges=true38ProtectSystem=strict39ProtectHome=true40PrivateTmp=true41ReadWritePaths=/var/lib/internetpressure /usr/local/bin/ip-probe42ProtectKernelTunables=true43ProtectControlGroups=true44RestrictSUIDSGID=true45LockPersonality=true46MemoryDenyWriteExecute=true47RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK48SystemCallArchitectures=native49LimitNOFILE=409650MemoryMax=256M5152[Install]53WantedBy=multi-user.target54