update where shell starts and add override -home setting
This commit is contained in:
@@ -33,6 +33,7 @@ Change with `-setlogin` before first use.
|
||||
| `-log off` | — | Disable file logging (console output always on) |
|
||||
| `-mfa <user> on` | — | Enable TOTP MFA for user — prints secret + QR code |
|
||||
| `-mfa <user> off` | — | Disable TOTP MFA for user |
|
||||
| `-home <path>` | `~` | Starting directory for new shell sessions |
|
||||
|
||||
---
|
||||
|
||||
@@ -101,26 +102,8 @@ Structured JSON-lines, one entry per login attempt:
|
||||
|
||||
## Run as service
|
||||
- `gotermix.service` is pretty limitted, you can change settings there to suit your needs
|
||||
```bash
|
||||
# 1. Create unprivileged system user (no shell, no home)
|
||||
useradd --system --no-create-home --shell /sbin/nologin gotermix
|
||||
|
||||
# 2. Deploy binary and set ownership
|
||||
mkdir -p /opt/gotermix
|
||||
cp gotermix /opt/gotermix/
|
||||
chown -R gotermix:gotermix /opt/gotermix
|
||||
chmod 750 /opt/gotermix
|
||||
chmod 750 /opt/gotermix/gotermix
|
||||
|
||||
# 3. Install and enable service
|
||||
cp gotermix.service /etc/systemd/system/
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now gotermix
|
||||
|
||||
# 4. Check it's up
|
||||
systemctl status gotermix
|
||||
journalctl -u gotermix -f
|
||||
```
|
||||
- there are 2 samples, `gotermix-limitted.service` has many settings what limits what this app and sessions in can do ( you may not even change user)
|
||||
- `gotermix.service` is pretty much normal full shell without restriction, run as specific user.
|
||||
|
||||
---
|
||||
|
||||
|
||||
Reference in New Issue
Block a user