[Unit]
Description=Overdeck credential-empty Subrouter authority
Documentation=file:/var/lib/overdeck/subrouter/current/receipt.json
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=overdeck-subrouter
Group=overdeck-subrouter
Environment=HOME=/var/lib/overdeck/subrouter/state/home
Environment=XDG_CONFIG_HOME=/var/lib/overdeck/subrouter/state/config
Environment=XDG_CACHE_HOME=/var/lib/overdeck/subrouter/state/cache
Environment=XDG_STATE_HOME=/var/lib/overdeck/subrouter/state/state
Environment=SUBROUTER_STATE_DIR=/var/lib/overdeck/subrouter/state
Environment=OVERDECK_SUBROUTER_SERVICE_IDENTITY=overdeck-subrouter
ExecStart=/var/lib/overdeck/subrouter/current/bin/subrouter serve --authority-mode --state-dir /var/lib/overdeck/subrouter/state --authority-admin-file /var/lib/overdeck/subrouter/state/authority-admin --addr 127.0.0.1:31415 --sr-switch-interval 0 --fetch-usage=false
Restart=on-failure
RestartSec=2
TimeoutStopSec=10min
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
ReadOnlyPaths=/var/lib/overdeck/subrouter/releases
ReadWritePaths=/var/lib/overdeck/subrouter/state
UMask=0077

[Install]
WantedBy=multi-user.target