[Unit]
Description=RustProxy reverse proxy
Documentation=https://rustproxy.linuxiarz.pl
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=rustproxy
Group=rustproxy
WorkingDirectory=/var/lib/rustproxy
Environment=MALLOC_ARENA_MAX=2
EnvironmentFile=-/etc/rustproxy/environment
ExecStart=/usr/bin/rust-proxy serve
Restart=on-failure
RestartSec=3s
KillSignal=SIGINT
KillMode=control-group
TimeoutStopSec=120s
UMask=0027

# Bind 80/443 without running the service as root.
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=true

# Runtime filesystem policy. Diagnostics intentionally retain normal /proc access.
StateDirectory=rustproxy
StateDirectoryMode=0750
LogsDirectory=rustproxy
LogsDirectoryMode=0750
RuntimeDirectory=rustproxy
RuntimeDirectoryMode=0750
ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
LockPersonality=true
RestrictRealtime=true
RestrictSUIDSGID=true
RestrictNamespaces=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native

# High enough for many frontend/upstream sockets without removing all limits.
LimitNOFILE=65536
TasksMax=4096

[Install]
WantedBy=multi-user.target