Daniele Fucini
3a2d2b7c37
Units, settings and setup README for the claude-rc user, which serves my projects' read-only MCP servers to the Claude app (negsplit for now).
40 lines
1.1 KiB
Desktop File
40 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Claude Code Remote Control (read-only MCP servers)
|
|
Wants=network-online.target
|
|
After=network-online.target mariadb.service
|
|
# about 50 min of failed starts (back-off below): give up and notify
|
|
StartLimitIntervalSec=1h
|
|
StartLimitBurst=8
|
|
OnFailure=claude-rc-notify.service
|
|
|
|
[Service]
|
|
User=claude-rc
|
|
Group=claude-rc
|
|
WorkingDirectory=/var/lib/claude-rc/data
|
|
# strips credentials from subprocess environments; on Linux also sandboxes ! shell commands
|
|
Environment=CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1
|
|
ExecStart=/usr/bin/claude remote-control --name data --spawn session
|
|
Restart=always
|
|
RestartSec=30s
|
|
RestartSteps=4
|
|
RestartMaxDelaySec=10min
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ReadWritePaths=/var/lib/claude-rc
|
|
PrivateTmp=yes
|
|
NoNewPrivileges=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
CapabilityBoundingSet=
|
|
RestrictSUIDSGID=yes
|
|
RestrictRealtime=yes
|
|
LockPersonality=yes
|
|
# no RestrictNamespaces/MemoryDenyWriteExecute: the Bash sandbox (bubblewrap) needs user namespaces
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|