[Unit]
Description=PQConnect server
After=network.target

[Service]
Type=simple
UMask=077
StandardInput=null
StandardOutput=journal
StandardError=journal
WorkingDirectory=/root/pqconnect
ExecStart=scripts/run-server-core
TimeoutStartSec=infinity
Restart=always
RestartSec=1s

CapabilityBoundingSet=CAP_NET_ADMIN CAP_SETUID CAP_SETGID CAP_KILL CAP_NET_BIND_SERVICE
DevicePolicy=strict
DeviceAllow=/dev/net/tun rwm
DeviceAllow=/dev/null rw
DeviceAllow=/dev/urandom r
LockPersonality=yes
MemoryMax=2G
NoNewPrivileges=yes
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=ptraceable
ProtectSystem=yes
ReadOnlyPaths=/
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=~@clock
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@debug
SystemCallFilter=~@module
SystemCallFilter=~@mount
SystemCallFilter=~@obsolete
SystemCallFilter=~@raw-io
SystemCallFilter=~@reboot
SystemCallFilter=~@swap

[Install]
WantedBy=multi-user.target
