Trestle
Operations

Run as a system service

Use a dedicated unprivileged account, an owner-only environment file and a local data directory.

[Unit]
Description=Trestle
After=network-online.target

[Service]
User=trestle
Group=trestle
EnvironmentFile=/etc/trestle/trestle.env
ExecStart=/usr/local/bin/trestle
Restart=on-failure
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/var/lib/trestle

[Install]
WantedBy=multi-user.target
TRESTLE_LISTEN=127.0.0.1:8090
TRESTLE_DATA_DIR=/var/lib/trestle
TRESTLE_TRUSTED_PROXIES=127.0.0.1/32

Make the environment file mode 0600 and the data directory mode 0700. Trestle normalizes its data-directory permissions at startup, but the service manager and parent directories remain operator responsibilities.

Shutdown

SIGTERM marks readiness false, stops background workers and drains HTTP work within the configured shutdown timeout.