78 lines
2.4 KiB
Desktop File
78 lines
2.4 KiB
Desktop File
# /etc/systemd/system/finai-backend.service
|
||
#
|
||
# 财务大模型智能问答客服系统 · FastAPI 后端
|
||
# 代码目录：/home/ubuntu/finai/backend
|
||
# 虚拟环境：/home/ubuntu/finai/backend/.venv
|
||
# .env ：/home/ubuntu/finai/backend/.env (DSN / JWT / ADP 等)
|
||
# 监听 ：127.0.0.1:8775 (Nginx /api/ 反代到这里)
|
||
#
|
||
# 部署：
|
||
# sudo cp /home/ubuntu/finai/deploy/systemd/finai-backend.service \
|
||
# /etc/systemd/system/finai-backend.service
|
||
# sudo systemctl daemon-reload
|
||
# sudo systemctl enable --now finai-backend
|
||
#
|
||
# 常用：
|
||
# sudo systemctl status finai-backend
|
||
# sudo systemctl restart finai-backend
|
||
# journalctl -u finai-backend -f
|
||
|
||
[Unit]
|
||
Description=Finai Backend (FastAPI)
|
||
Documentation=https://finai.ctc-zc.com
|
||
After=network-online.target postgresql.service redis-server.service
|
||
Wants=network-online.target postgresql.service redis-server.service
|
||
|
||
[Service]
|
||
Type=simple
|
||
User=ubuntu
|
||
Group=ubuntu
|
||
|
||
WorkingDirectory=/home/ubuntu/finai/backend
|
||
EnvironmentFile=/home/ubuntu/finai/backend/.env
|
||
|
||
ExecStart=/home/ubuntu/finai/backend/.venv/bin/uvicorn app.main:app \
|
||
--host 127.0.0.1 \
|
||
--port 8775 \
|
||
--workers 2 \
|
||
--proxy-headers \
|
||
--forwarded-allow-ips=127.0.0.1
|
||
|
||
# 收到 SIGTERM 后给 uvicorn 15s 优雅退出（结束在途 SSE 流）
|
||
KillSignal=SIGTERM
|
||
TimeoutStopSec=15
|
||
|
||
Restart=always
|
||
RestartSec=3
|
||
StartLimitBurst=5
|
||
StartLimitIntervalSec=60
|
||
|
||
# 让 stdout/stderr 走 journal（journalctl -u finai-backend 直接看）
|
||
StandardOutput=journal
|
||
StandardError=journal
|
||
SyslogIdentifier=finai-backend
|
||
|
||
# ─── 基础加固 ────────────────────────────────────────────────
|
||
NoNewPrivileges=true
|
||
PrivateTmp=true
|
||
ProtectSystem=full
|
||
# 工作目录在 /home/ubuntu，必须放开 /home 保护
|
||
ProtectHome=false
|
||
# 精确开放需要写的路径（storage 落图片、SQLite/日志 等）
|
||
ReadWritePaths=/home/ubuntu/finai/backend
|
||
ProtectKernelTunables=true
|
||
ProtectKernelModules=true
|
||
ProtectControlGroups=true
|
||
RestrictSUIDSGID=true
|
||
LockPersonality=true
|
||
MemoryDenyWriteExecute=true
|
||
RestrictRealtime=true
|
||
# 只允许 IPv4/IPv6/UNIX，屏蔽奇葩地址簇
|
||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||
|
||
# ─── 资源限制 ────────────────────────────────────────────────
|
||
LimitNOFILE=65535
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|