[Unit]
Description=xmpp-proxy
After=network-online.target nss-lookup.target
Wants=network-online.target nss-lookup.target
StartLimitIntervalSec=0
Documentation=https://code.moparisthebest.com/moparisthebest/xmpp-proxy
Documentation=https://github.com/moparisthebest/xmpp-proxy

[Service]
ExecStart=/usr/bin/xmpp-proxy
Restart=always
RestartSec=1s
# anything under here isn't strictly needed, but probably good
# to lock this down with the minimal permissions necessary
# which are not many at all
User=xmpp-proxy
DynamicUser=yes
ConfigurationDirectory=xmpp-proxy
ConfigurationDirectoryMode=0750
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectHostname=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=net
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true
RemoveIPC=true
SystemCallArchitectures=native
# these are just needed to bind to low ports
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE

# this is any existing group the key/cert can be owned by
# so that our random user can read them
# not needed at all without TLS, can comment out
# see https://github.com/systemd/systemd/issues/9535
SupplementaryGroups=systemd-network

[Install]
WantedBy=multi-user.target