userver.service.in

[Unit]
Description=ULib server
Documentation=http://stefanocasazza.github.io/ULib/
After=network-online.target
Wants=network-online.target systemd-networkd-wait-online.service

[Service]
Restart=on-failure
StartLimitInterval=86400
StartLimitBurst=5
PrivateDevices=true
ProtectControlGroups=true
ProtectHome=true
ProtectKernelTunables=true
ProtectSystem=full
RestrictSUIDSGID=true
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
MemoryDenyWriteExecute=true
ProtectHostname=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
LockPersonality=true
SystemCallArchitectures=native
InaccessiblePaths=/usr/bin/at
InaccessiblePaths=/usr/bin/cron
InaccessiblePaths=/usr/bin/bash
InaccessiblePaths=/usr/bin/sh
InaccessiblePaths=/usr/bin/zsh
InaccessiblePaths=/usr/bin/wget
InaccessiblePaths=/usr/bin/curl
InaccessiblePaths=/usr/bin/ssh
InaccessiblePaths=/usr/bin/scp
InaccessiblePaths=/usr/bin/python
InaccessiblePaths=/usr/bin/perl
InaccessiblePaths=/usr/local/

; User and group the process will run as.
User=www-data
Group=www-data

ExecStart=@ULIB_PREFIXDIR@/bin/userver_tcp -c @ULIB_SYSCONFDIR@/userver.cfg

; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
LimitNOFILE=1048576

; Use private /tmp and /var/tmp, which are discarded after userver stops.
PrivateTmp=true
; Use a minimal /dev
PrivateDevices=true
; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
ProtectHome=true
; Make /usr, /boot, /etc and possibly some more folders read-only.
ProtectSystem=full

; The following additional security directives only work with systemd v229 or later.
; They further retrict privileges that can be gained by userver. Uncomment if you like.
; Note that you may have to add capabilities required by any plugins in use.
;CapabilityBoundingSet=CAP_NET_BIND_SERVICE
;AmbientCapabilities=CAP_NET_BIND_SERVICE
;NoNewPrivileges=true

[Install]
WantedBy=multi-user.target