Installing Boundary under Systemd

This section covers how to install Boundary under the Systemd init system on modern Linux distributions. In this section we’ll cover an example of breaking out the controller and worker servers onto separate instances, though you can opt to run both on a single server.

Filesystem Configuration

TYPE below can be either worker or controller if you want to run them independently, e.g. for high availability. If you want to run combined nodes, modify as desired.

  1. /etc/boundary-${TYPE}.hcl: Configuration file for the boundary service See above example configurations.

  2. /usr/local/bin/boundary: The Boundary binary. Can build from GitHub repository or download binary from our release pages.

  3. /etc/systemd/system/boundary-${TYPE}.service: Systemd unit file for the Boundary service Example:

User & Group Configuration

We recommend running Boundary as a non-root user, and use this user to manage the Boundary process running under systemd. The example init files here do exactly this, and our example install script below creates a user and group on Debian-like Ubuntu systems as an example.

Systemd Unit file

  1. [Unit]
  2. Description=${NAME} ${TYPE}
  4. [Service]
  5. ExecStart=/usr/local/bin/${NAME} ${TYPE} -config /etc/${NAME}-${TYPE}.hcl
  6. User=boundary
  7. Group=boundary
  8. LimitMEMLOCK=infinity
  9. Capabilities=CAP_IPC_LOCK+ep
  10. CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
  12. [Install]
  13. WantedBy=multi-user.target

Systemd All-in-One Installation Script

Here’s a simple install script that creates the boundary group and user, installs the systemd unit file and enables it at startup:

  1. #!/bin/bash
  2. # Installs the boundary as a service for systemd on linux
  3. # Usage: ./install.sh <worker|controller>
  5. TYPE=$1
  6. NAME=boundary
  8. sudo cat << EOF > /etc/systemd/system/${NAME}-${TYPE}.service
  9. [Unit]
  10. Description=${NAME} ${TYPE}
  12. [Service]
  13. ExecStart=/usr/local/bin/${NAME} ${TYPE} -config /etc/${NAME}-${TYPE}.hcl
  14. User=boundary
  15. Group=boundary
  16. LimitMEMLOCK=infinity
  17. Capabilities=CAP_IPC_LOCK+ep
  18. CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
  20. [Install]
  21. WantedBy=multi-user.target
  22. EOF
  24. # Add the boundary system user and group to ensure we have a no-login
  25. # user capable of owning and running Boundary
  26. sudo adduser --system --group boundary || true
  27. sudo chown boundary:boundary /etc/${NAME}-${TYPE}.hcl
  28. sudo chown boundary:boundary /usr/local/bin/boundary
  30. # Make sure to initialize the DB before starting the service. This will result in
  31. # a database already initizalized warning if another controller or worker has done this
  32. # already, making it a lazy, best effort initialization
  33. if [ "${TYPE}" = "controller" ]; then
  34.   sudo /usr/local/bin/boundary database init -config /etc/${NAME}-${TYPE}.hcl || true
  35. fi
  37. sudo chmod 664 /etc/systemd/system/${NAME}-${TYPE}.service
  38. sudo systemctl daemon-reload
  39. sudo systemctl enable ${NAME}-${TYPE}
  40. sudo systemctl start ${NAME}-${TYPE}