faculty_manager.service

[Unit]
Description=CourtJester bot
After=multi-user.target

[Service]
# Base settings
Type=simple
Restart=always
RestartSec=10

# Execution parameters
User=courtjester
Group=courtjester
WorkingDirectory=/home/faculty_manager/faculty_manager
Environment = "SCRIPT_ARGS=info.json"
ExecStart=/home/faculty_manager/faculty_manager/faculty_manager $SCRIPT_ARGS

# Limit damage in case something goes awry
MemoryLimit=256M
CPUQuota=200%

# Security
PrivateTmp=true
ProtectSystem=full
NoNewPrivileges=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
PrivateDevices=true
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target