[Unit]
Description=TS3 Monolith - panel TeamSpeak 3 (tworzenie kanalow + statystyki RRD)
Documentation=https://github.com/linuxiarz/ts3-monolith-go
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=ts3monolith
Group=ts3monolith
WorkingDirectory=/var/lib/ts3monolith
EnvironmentFile=/etc/default/ts3monolith
ExecStart=/usr/bin/ts3monolith
Restart=on-failure
RestartSec=3s
UMask=0027
StateDirectory=ts3monolith
StateDirectoryMode=0750

# Hardening. Usluga nie wymaga zadnych uprawnien poza siecia (TS3 ServerQuery,
# HTTP) i zapisem do /var/lib/ts3monolith (RRD + wygenerowane wykresy PNG).
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/var/lib/ts3monolith
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
RestrictSUIDSGID=true
RestrictNamespaces=true
RestrictRealtime=true
RestrictAddressFamilies=AF_INET AF_INET6
LockPersonality=true
CapabilityBoundingSet=
AmbientCapabilities=
SystemCallArchitectures=native
SystemCallFilter=@system-service

# MemoryDenyWriteExecute=true i SystemCallFilter=~@privileged @resources sa
# NIE wlaczone celowo: sa znanym zrodlem "code=dumped, signal=SYS" (seccomp
# zabija proces) dla binarek Go, w przeciwienstwie do np. Rusta/LLVM. Jesli
# chcesz dokrecic bardziej, wlaczaj je pojedynczo i patrz na
# `journalctl -u ts3monolith` / `dmesg | grep -i seccomp` po kazdej zmianie.

[Install]
WantedBy=multi-user.target