INN commit: branches/2.6/contrib (sample.init.systemd)

[INN Commit]

    Date: Monday, January 11, 2021 @ 13:55:08
  Author: iulius
Revision: 10507

Improve sample init systemd script

Thanks to Marco d'Itri, Debian packager of INN, for the ideas.
Also enable notify type.

Modified:
  branches/2.6/contrib/sample.init.systemd

---------------------+
 sample.init.systemd |   19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

Modified: sample.init.systemd
===================================================================
--- sample.init.systemd	2021-01-11 21:54:36 UTC (rev 10506)
+++ sample.init.systemd	2021-01-11 21:55:08 UTC (rev 10507)
@@ -5,26 +5,27 @@
 [Unit]
 Description=InterNetNews News Server
 Documentation=https://www.eyrie.org/~eagle/software/inn/
-After=network.target
+After=network-online.target
+Wants=network-online.target
 ConditionPathExists=/etc/news/inn.conf
 
 [Service]
-Type=forking
+Type=notify
+Restart=on-abort
 ExecStart=/usr/lib/news/bin/rc.news
 ExecReload=/usr/sbin/ctlinnd -t 20 reload '' 'systemd unit reload'
-ExecStop=/bin/su -m news -s /bin/sh -c '/usr/lib/news/bin/rc.news stop'
+ExecStop=/usr/lib/news/bin/rc.news stop
 PIDFile=/run/news/innd.pid
 User=news
 Group=news
 AmbientCapabilities=CAP_NET_BIND_SERVICE
-PrivateDevices=true
 PrivateTmp=true
 ProtectControlGroups=true
 ProtectHome=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
 ProtectSystem=full
 RuntimeDirectory=news
+LimitNOFILE=infinity
+ReadWritePaths=/var/spool/news/
 # Setting NoNewPrivileges will break most local sendmail implementations
 # because they're setuid or setgid to drop off mail in the mail queue.  With
 # this configuration, one can use mSMTP as the configured mta, set to forward
@@ -31,6 +32,12 @@
 # mail via SMTP to localhost.  Nevertheless, one can probably do better than
 # this by adding some syscall filtering.
 #NoNewPrivileges=true
+#
+# These directives automatically enable NoNewPrivileges, and are therefore
+# incompatible:
+#PrivateDevices=true
+#ProtectKernelModules=true
+#ProtectKernelTunables=true
 
 [Install]
 WantedBy=multi-user.target