# Installed by deploy/setup.sh to /etc/systemd/system/hito.service.
# Edit this file, not the installed copy: install and deploy overwrite it.

[Unit]
Description=hito — High Intensity Trainer Online
After=network.target

[Service]
Type=simple
User=hito
Group=hito
WorkingDirectory=/srv/hito/current
ExecStart=/srv/hito/current/_build/default/bin/main.exe
Restart=on-failure
RestartSec=5

# EnvironmentFile= values override Environment= values, whatever the order.
Environment=HITO_DB=sqlite3:/srv/hito/data/hito.sqlite
Environment=HITO_PORT=8080
# HITO_VERSION, rewritten by every deploy.
EnvironmentFile=/srv/hito/shared/deploy.env
# Host secrets (HITO_SECRET and so on). Keep it root:root 0600.
EnvironmentFile=/etc/hito/hito.env

# Hardening. Only the database directory is writable.
UMask=0077
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/srv/hito/data
InaccessiblePaths=/srv/git
PrivateTmp=yes
PrivateDevices=yes
CapabilityBoundingSet=
AmbientCapabilities=
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictSUIDSGID=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service

[Install]
WantedBy=multi-user.target