systemd Borg Backup without root I use Borg Backup as my current backup software. I'm not going into details about using borg here, I will show you how you can write a systemd service that can backup all files on your system without running as root. This also applies to other backup software not just
systemd Use TemporaryFileSystem to hide files or directories from systemd services For decades people used chroot to restrict the access a service has to the filesystem tree. This was never meant to be a security boundary and there are many ways to break out of it. Implementations got better over time, but where never good enough to be called a security
systemd Continuously import Logfiles into journald I use Journalbeat to forward my systemd-journal to Logstash/Elasticsearch. When possible, I configure every software on my servers to log to syslog which on moderns systems means logging to systemd-journald. If they don't support syslog I can also log to stdout which systemd writes to the syslog by default
nginx Running NGINX without root Update 08.01.2021: Use LogsDirectory and CacheDirectory instead of ReadWritePaths. I like creating my own systemd services for software that hasn't one or only a very basic one with little to no sandboxing. See my goals when creating my own services and explanations for all the sandboxing features here:
