Separate jupyterhub & chp services

Allows restarting hub for config changes without disrupting user
service!

tljh/systemd-units/configurable-http-proxy.service

@@ -0,0 +1,22 @@
+# Template file for Configurable HTTP Proxy systemd service
+# Uses simple string.format() for 'templating'
+[Unit]
+Wants=network-online.target
+
+[Service]
+User=root
+Restart=always
+# chp process should have no write access anywhere on disk
+ProtectHome=tmpfs
+ProtectSystem=strict
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+EnvironmentFile=/etc/jupyterhub/configurable-http-proxy.secret
+ExecStart={install_prefix}/hub/bin/configurable-http-proxy \
+            --ip 0.0.0.0 \
+            --port 80 \
+            --api-ip 127.0.0.1 \
+            --api-port 8001 \
+            --error-target http://127.0.0.1:8081/hub/error

tljh/systemd-units/jupyterhub.service

@@ -1,13 +1,22 @@
 # Template file for JupyterHub systemd service
-# Runs both JupyterHub and ConfigurableHTTPProxy
 # Uses simple string.format() for 'templating'
 [Unit]
-Wants=network-online.target
+Wants=configurable-http-proxy.service
 
 [Service]
 User=root
 Restart=always
-Environment=TLJH_INSTALL_PREFIX={install_prefix}
+# jupyterhub process should have no access to home directories
+ProtectHome=tmpfs
+# Use a persistent, permissioned state directory for db + cookie secrets
 StateDirectory=jupyterhub
 WorkingDirectory=/var/lib/jupyterhub
+# Protect bits that are normally shared across the system
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+# Source CONFIGPROXY_AUTH_TOKEN from here!
+EnvironmentFile=/etc/jupyterhub/configurable-http-proxy.secret
+Environment=TLJH_INSTALL_PREFIX={install_prefix}
 ExecStart={python_interpreter_path} -m jupyterhub.app -f {jupyterhub_config_path}