[Unit]
Description=hostebin file bundle host
Documentation=https://github.com/readeem/hostebin
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/hostebin serve
Restart=on-failure
RestartSec=5s

# systemd creates and owns /var/lib/hostebin for an ephemeral service user, so
# the package needs no useradd in a postinstall script.
DynamicUser=yes
StateDirectory=hostebin
Environment=XDG_DATA_HOME=/var/lib/hostebin
Environment=XDG_CONFIG_HOME=/var/lib/hostebin/config
# Drop-in overrides go in /etc/systemd/system/hostebin.service.d/, or set
# HOSTEBIN_* variables in this file:
EnvironmentFile=-/etc/default/hostebin

# Only needed when binding :80/:443 directly (--acme-domain).
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictSUIDSGID=yes
LockPersonality=yes
SystemCallFilter=@system-service
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target