From 24ceb1353ec61a50fdfddc63d4bfc0b00d529b00 Mon Sep 17 00:00:00 2001 From: wangdl Date: Fri, 19 Jun 2026 21:26:47 +0800 Subject: [PATCH] fix: remove ProtectSystem/ReadWritePaths from systemd units ProtectSystem=strict requires /run/systemd/unit-root paths to exist which fails on production. Worker only needs network access (Redis/MySQL). Co-Authored-By: Claude Opus 4.7 --- deploy/zhixi-nest-api.service | 4 ---- deploy/zhixi-nest-worker.service | 3 --- 2 files changed, 7 deletions(-) diff --git a/deploy/zhixi-nest-api.service b/deploy/zhixi-nest-api.service index 8e883ff..f1ea518 100644 --- a/deploy/zhixi-nest-api.service +++ b/deploy/zhixi-nest-api.service @@ -20,10 +20,6 @@ EnvironmentFile=/opt/zhixi/env/.env.production # Security NoNewPrivileges=yes -ProtectSystem=strict -ProtectHome=yes -ReadWritePaths=/opt/zhixi/api-server/uploads -ReadWritePaths=/opt/zhixi/api-server/prisma # Logging StandardOutput=journal diff --git a/deploy/zhixi-nest-worker.service b/deploy/zhixi-nest-worker.service index 9d910c4..2c3704d 100644 --- a/deploy/zhixi-nest-worker.service +++ b/deploy/zhixi-nest-worker.service @@ -26,9 +26,6 @@ MemoryMax=512M # Security NoNewPrivileges=yes -ProtectSystem=strict -ProtectHome=yes -ReadWritePaths=/opt/zhixi/backend/uploads # Logging StandardOutput=journal