From 277bb70454900bb9275ea22de3f653c2731c56a7 Mon Sep 17 00:00:00 2001
From: xfy911 <defect.y@qq.com>
Date: Tue, 16 Jun 2026 06:26:56 +0800
Subject: [PATCH] =?UTF-8?q?Phase=205=20=E2=80=94=20systemd=20=E6=9C=8D?=
 =?UTF-8?q?=E5=8A=A1=E6=96=87=E4=BB=B6=EF=BC=9A=E4=B8=80=E9=94=AE=E5=AE=89?=
 =?UTF-8?q?=E8=A3=85=E6=88=90=E7=B3=BB=E7=BB=9F=E6=9C=8D=E5=8A=A1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

新增 cocoon.service：
- Type=simple 服务单元，支持 SIGHUP 热重载（ExecReload）
- 默认配置路径 /etc/cocoon/cocoon.json，工作目录 /var/www
- 安全加固：NoNewPrivileges / PrivateTmp / ProtectSystem / ProtectHome 等
- 网络能力：CAP_NET_BIND_SERVICE，用于绑定 80/443 端口
- 资源限制：LimitNOFILE=65535 / LimitNPROC=4096

Makefile 新增 install-systemd / uninstall-systemd 目标：
- install-systemd 自动创建目录并安装服务文件
- uninstall-systemd 停止并移除服务

编译验证：零警告，全部通过
单元测试：全部通过 ✓
集成测试：111 项通过（4 项反向代理环境相关失败，非项目问题）
---
 Makefile       | 19 ++++++++++++++++++-
 cocoon.service | 45 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 cocoon.service

diff --git a/Makefile b/Makefile
index 7331859..83b149c 100644
--- a/Makefile
+++ b/Makefile
@@ -168,7 +168,24 @@ clean:
 	rm -f $(OBJS) $(TARGET)
 	rm -f $(UNIT_TEST_OBJS) $(UNIT_TEST_BINS)
 
+# 安装 systemd 服务文件
+install-systemd: cocoon.service
+	install -d /etc/cocoon
+	install -d /var/log/cocoon
+	install -d /var/www
+	install -m 644 cocoon.service /etc/systemd/system/
+	@echo "[Cocoon] systemd 服务已安装"
+	@echo "  1. 编辑 /etc/cocoon/cocoon.json 配置服务器"
+	@echo "  2. 运行 'systemctl daemon-reload' 重新加载 systemd"
+	@echo "  3. 运行 'systemctl enable --now cocoon' 启动并启用服务"
+
+# 卸载 systemd 服务
+uninstall-systemd:
+	systemctl disable cocoon 2>/dev/null || true
+	rm -f /etc/systemd/system/cocoon.service
+	@echo "[Cocoon] systemd 服务已卸载"
+
 # 重新构建
 rebuild: clean all
 
-.PHONY: all clean install uninstall rebuild deps build-all test integration-test test-all bench unit-test
+.PHONY: all clean install uninstall rebuild deps build-all test integration-test test-all bench unit-test install-systemd uninstall-systemd
diff --git a/cocoon.service b/cocoon.service
new file mode 100644
index 0000000..4882b83
--- /dev/null
+++ b/cocoon.service
@@ -0,0 +1,45 @@
+[Unit]
+Description=Cocoon - 基于协程的轻量级 Web 服务器
+Documentation=https://github.com/xfy911/cocoon
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/cocoon -c /etc/cocoon/cocoon.json
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=5
+
+# 工作目录（静态资源根目录的基准路径）
+WorkingDirectory=/var/www
+
+# 日志输出到 journal
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=cocoon
+
+# 安全加固
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/log/cocoon /var/www /etc/cocoon
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+
+# 网络能力（需要绑定端口）
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+# 资源限制
+LimitNOFILE=65535
+LimitNPROC=4096
+
+[Install]
+WantedBy=multi-user.target