Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Configuration › systemd Units

systemd Units

SharedStatus: SUPPORTED as unit facts from deploy/-systemdAudience: Linux administrator

Purpose

Identify the units an operator starts, who they run as, and how they fail.

Exact units

Scroll sideways to see the full table. Use the arrow keys when focused.

UnitRoleUserExecStart (from unit)Reload
zwall-manager.serviceManagerzwall-manager/opt/zwall-manager/bin/zwall-manager -config /etc/zwall-manager/manager.ymlExecReload=/bin/kill -HUP $MAINPID
zwall-agent.serviceVirtualization Agentroot/opt/zcs/bin/zwall-agent --config /etc/zcs/agent.ymlnone in unit
zwall-hosting-agent.serviceHosting Agent (v1 path)zwall-hosting/opt/zwall-hosting/bin/zwall-agent --config /etc/zwall-hosting/agent.ymlnone
zwall-hosting-agent-v2.serviceHosting Agent v2zwall-hosting/opt/zwall-hosting/bin/zwall-agent --config /etc/zwall-hosting/agent-v2.ymlnone
zwall-hosting-ebpf-loader.servicepass-only observer loaderroot/opt/zwall-hosting/bin/zwall-hosting-ebpf-loader --object /opt/zwall-hosting/ebpf/hosting_observe.o --sha256 ${ZWALL_HOSTING_EBPF_SHA256} --interfaces ${ZWALL_HOSTING_INTERFACES} --run-user zwall-hosting --run-group zwall-hostingExecStop=... --detach

Templates present in tree (release-specific, not daily ops): zwall-hosting-agent-upgrade-preflight.service.in, zwall-manager-migrate-v58*.service.in. Community scripts/setup.sh may write zwall-manager and zwall-agent with Community paths.

Do not copy any Hosting unit Documentation= URL (lab host). This page omits it on purpose.

Ordering

  • Manager: After=network-online.target postgresql.service
  • Virt Agent: After=network-online.target
  • Hosting v2 Agent: After=network-online.target zwall-hosting-ebpf-loader.service; Wants= the loader
  • Loader: Before=zwall-hosting-agent-v2.service

Hardening that is product-enforced in the unit (not a certified standard)

  • Manager: NoNewPrivileges, PrivateTmp, ProtectSystem=strict, ProtectHome, empty CapabilityBoundingSet, UMask=0077, Restart=on-failure, RestartSec=5.
  • Virtualization Agent: root with CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN CAP_SYS_RESOURCE, ReadWritePaths including /sys/fs/bpf.
  • Hosting Agent: empty capabilities, unprivileged user, SupplementaryGroups v1 adm psaserv / v2 adm only. v2 comments that Plesk/site sources stay permission_blocked until operator ACLs.
  • Loader: CapabilityBoundingSet=CAP_CHOWN CAP_SYS_ADMIN CAP_NET_ADMIN for pass-only attach and detach. Unprivileged Agent gets no capability.

Restart / reload

Scroll sideways to see the full table. Use the arrow keys when focused.

ActionManagerVirt AgentHosting
systemctl start/stop/restartyesyesstart loader then Agent; stop Agent then loader
systemctl reloadHUP on Manager onlynono

HUP is not a certified live-apply of every YAML key. zwallctl start/stop are not remote power control.