allow ipset to clean up tables when receiving sigterm

crowdsecurity · Oct 26, 2023 · 72af906 · 72af906
1 parent 015adae
commit 72af906
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/config/crowdsec-firewall-bouncer.service b/config/crowdsec-firewall-bouncer.service
@@ -11,6 +11,9 @@ ExecStartPost=/bin/sleep 0.1
 Restart=always
 RestartSec=10
 LimitNOFILE=65536
+# don't send a termination signal to the children processes,
+# because the iptables backend needs to run ipset multiple times to properly shutdown
+KillMode=mixed
 
 [Install]
 WantedBy=multi-user.target