From bb45b12809b57161fc44fbf1757c5a39c9a4c63d Mon Sep 17 00:00:00 2001 From: ginuerzh Date: Mon, 21 Sep 2026 21:15:33 +0800 Subject: [PATCH] fix(release): use DynamicUser for gost.service systemd-analyze verify warns "Special user nobody configured, this is not safe!": nobody is a shared account, so any other service running as it can read and write /run/gost. DynamicUser= gives the unit its own transient identity, named gost, without adding a static user to the package. Verified under a real systemd: the unit starts, binds :80 through the ambient capabilities, runs as the dynamic user, and is skipped rather than failed when /etc/gost/gost.yml is absent. --- gost.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gost.service b/gost.service index e2b2f6f..c029b15 100644 --- a/gost.service +++ b/gost.service @@ -10,7 +10,7 @@ WorkingDirectory=/run/gost ExecStart=/usr/bin/gost -C /etc/gost/gost.yml ExecReload=/bin/kill -SIGHUP $MAINPID -User=nobody +DynamicUser=yes RuntimeDirectory=gost LogsDirectory=gost TimeoutStopSec=5s